@vex-chat/spire 2.5.0 → 3.0.0

package/src/__tests__/connectAuth.spec.ts

@@ -0,0 +1,120 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { xSignAsync, xSignKeyPair, XUtils } from "@vex-chat/crypto";
+import { TokenScopes } from "@vex-chat/types";
+
+import jwt from "jsonwebtoken";
+import { parse as uuidParse } from "uuid";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { initApp } from "../server/index.ts";
+import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { msgpack } from "../utils/msgpack.ts";
+
+const originalJwtSecret = process.env["JWT_SECRET"];
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+describe("device connect auth", () => {
+    afterEach(() => {
+        if (originalJwtSecret === undefined) {
+            delete process.env["JWT_SECRET"];
+        } else {
+            process.env["JWT_SECRET"] = originalJwtSecret;
+        }
+    });
+
+    it("allows a password-created account to connect before passkey enrollment", async () => {
+        process.env["JWT_SECRET"] = "test-jwt-secret";
+        const connectToken = "93ce482b-a0f2-4f6e-b1df-3aed61073552";
+        const signKeys = xSignKeyPair();
+        const device: Device = {
+            deleted: false,
+            deviceID: "device-a",
+            lastLogin: new Date(0).toISOString(),
+            name: "desktop",
+            owner: user.userID,
+            signKey: XUtils.encodeHex(signKeys.publicKey),
+        };
+        const db = {
+            retrieveDevice: (deviceID: string) =>
+                Promise.resolve(deviceID === device.deviceID ? device : null),
+        } as unknown as Database;
+        const app = express();
+        initApp(
+            app,
+            db,
+            (key, scope) =>
+                key === connectToken && scope === TokenScopes.Connect,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const signed = await xSignAsync(
+                Uint8Array.from(uuidParse(connectToken)),
+                signKeys.secretKey,
+            );
+            const token = jwt.sign({ user }, getJwtSecret());
+
+            const res = await fetch(
+                `http://127.0.0.1:${String(address.port)}/device/${device.deviceID}/connect`,
+                {
+                    body: msgpack.encode({ signed }),
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        "Content-Type": "application/msgpack",
+                    },
+                    method: "POST",
+                },
+            );
+
+            expect(res.status).toBe(200);
+            const body = msgpack.decode(
+                new Uint8Array(await res.arrayBuffer()),
+            ) as { deviceToken?: unknown };
+            expect(typeof body.deviceToken).toBe("string");
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((err) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}

package/src/__tests__/entitlements.spec.ts

@@ -0,0 +1,241 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { buildAccountEntitlements } from "@vex-chat/types";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devEntitlementRoutesEnabled,
+    getEntitlementRouter,
+} from "../server/entitlements.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}
+
+describe("Database account entitlements", () => {
+    it("returns a computed free snapshot when the user has no row", async () => {
+        expect.assertions(7);
+        await withDb(async (db) => {
+            const entitlements = await db.retrieveAccountEntitlements(userID);
+
+            expect(entitlements.userID).toBe(userID);
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("default");
+            expect(entitlements.expiresAt).toBeNull();
+            expect(
+                entitlements.capabilities["attachments.encrypted_uploads"],
+            ).toBe(true);
+            expect(entitlements.capabilities["calls.relay_priority"]).toBe(
+                false,
+            );
+            expect(entitlements.limits["devices.max_trusted_devices"]).toBe(2);
+        });
+    });
+
+    it("persists a dev override tier and derives its capabilities", async () => {
+        expect.assertions(5);
+        await withDb(async (db) => {
+            const updated = await db.setAccountEntitlementTier(userID, "pro", {
+                source: "dev_override",
+            });
+            const retrieved = await db.retrieveAccountEntitlements(userID);
+
+            expect(updated.tier).toBe("pro");
+            expect(retrieved.tier).toBe("pro");
+            expect(retrieved.source).toBe("dev_override");
+            expect(retrieved.capabilities["calls.relay_priority"]).toBe(true);
+            expect(retrieved.limits["attachments.max_encrypted_bytes"]).toBe(
+                500 * 1024 * 1024,
+            );
+        });
+    });
+});
+
+describe("dev entitlement route guard", () => {
+    it("is disabled by default and in production", () => {
+        expect(devEntitlementRoutesEnabled({})).toBe(false);
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+
+    it("requires an explicit flag and dev API key", () => {
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(true);
+        expect(
+            devEntitlementRoutesEnabled({
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+});
+
+describe("entitlement routes", () => {
+    it("returns the authenticated user's entitlement snapshot", async () => {
+        const retrieveAccountEntitlements = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({ tier: "plus", userID: id }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/user/${userID}/entitlements?format=json`,
+        );
+        const body = (await res.json()) as { tier?: unknown; userID?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ tier: "plus", userID });
+        expect(retrieveAccountEntitlements).toHaveBeenCalledWith(userID);
+    });
+
+    it("does not mount the dev override route unless explicitly enabled", async () => {
+        const setAccountEntitlementTier = vi.fn();
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: { "Content-Type": "application/json" },
+                method: "PATCH",
+            },
+        );
+
+        expect(res.status).toBe(404);
+        expect(setAccountEntitlementTier).not.toHaveBeenCalled();
+    });
+
+    it("allows dev overrides only with the explicit flag and dev API key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_ENABLE_DEV_ENTITLEMENTS"] = "1";
+        process.env["DEV_API_KEY"] = "local-secret";
+
+        const setAccountEntitlementTier = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({
+                    source: "dev_override",
+                    tier: "pro",
+                    userID: id,
+                }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const notify = vi.fn();
+        const { baseUrl } = mountEntitlementRouter(db, notify);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-dev-api-key": "local-secret",
+                },
+                method: "PATCH",
+            },
+        );
+        const body = (await res.json()) as { source?: unknown; tier?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ source: "dev_override", tier: "pro" });
+        expect(setAccountEntitlementTier).toHaveBeenCalledWith(userID, "pro", {
+            expiresAt: null,
+            source: "dev_override",
+        });
+        expect(notify).toHaveBeenCalledWith(
+            userID,
+            "accountEntitlementsChanged",
+            expect.any(String),
+            { tier: "pro" },
+        );
+    });
+});
+
+function mountEntitlementRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getEntitlementRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}

package/src/__tests__/notifyFanout.spec.ts

@@ -8,8 +8,6 @@ import type { ClientManager } from "../ClientManager.ts";
 import type { Database, NotificationSubscription } from "../Database.ts";
 import type { BaseMsg } from "@vex-chat/types";
 
-import { generateKeyPairSync } from "node:crypto";
-
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { NotificationService } from "../NotificationService.ts";
@@ -537,140 +535,6 @@ describe("Spire notify fanout", () => {
         });
     });
 
-    it("sends Expo callWake pushes with opaque call data", async () => {
-        const callSubscription: NotificationSubscription = {
-            ...subscription,
-            events: ["callWake"],
-            subscriptionID: "sub-call",
-        };
-        const fetchMock = vi.fn().mockResolvedValueOnce({
-            json: () =>
-                Promise.resolve({
-                    data: [{ id: "receipt-a", status: "ok" }],
-                }),
-            ok: true,
-        });
-        vi.stubGlobal("fetch", fetchMock);
-
-        const { db } = createSpireHarness([], [callSubscription]);
-        const service = new NotificationService(db, [], () => {});
-
-        await service["notifyPush"]({
-            data: {
-                callID: "call-1",
-                expiresAt: "2026-06-05T12:01:00.000Z",
-                mailID: "mail-1",
-                mailNonce: "abcd",
-            },
-            deviceID: callSubscription.deviceID,
-            event: "callWake",
-            transmissionID: "00000000-0000-0000-0000-000000000017",
-            userID: callSubscription.userID,
-        });
-
-        const init = fetchMock.mock.calls[0]?.[1] as
-            | undefined
-            | { body?: unknown };
-        const messages = JSON.parse(String(init?.body)) as Array<{
-            body?: string;
-            data?: Record<string, unknown>;
-            title?: string;
-        }>;
-        expect(messages[0]?.title).toBe("Incoming Vex call");
-        expect(messages[0]?.body).toBe("Incoming voice call.");
-        expect(messages[0]?.data).toMatchObject({
-            callID: "call-1",
-            event: "callWake",
-            expiresAt: "2026-06-05T12:01:00.000Z",
-            mailID: "mail-1",
-            mailNonce: "abcd",
-            transmissionID: "00000000-0000-0000-0000-000000000017",
-        });
-        expect(messages[0]?.data).not.toHaveProperty("callerUserID");
-        expect(messages[0]?.data).not.toHaveProperty("sdp");
-    });
-
-    it("sends FCM call pushes as high-priority opaque data", async () => {
-        const { privateKey } = generateKeyPairSync("rsa", {
-            modulusLength: 2048,
-        });
-        const fcmSubscription: NotificationSubscription = {
-            ...subscription,
-            channel: "fcmCall",
-            events: ["callWake"],
-            platform: "android",
-            subscriptionID: "sub-fcm",
-            token: "fcm-token",
-        };
-        const fetchMock = vi
-            .fn()
-            .mockResolvedValueOnce({
-                json: () => Promise.resolve({ access_token: "access-token" }),
-                ok: true,
-            })
-            .mockResolvedValueOnce({
-                ok: true,
-            });
-        vi.stubGlobal("fetch", fetchMock);
-
-        process.env["SPIRE_FCM_CLIENT_EMAIL"] = "spire@example.invalid";
-        process.env["SPIRE_FCM_PRIVATE_KEY"] = privateKey.export({
-            format: "pem",
-            type: "pkcs8",
-        });
-        process.env["SPIRE_FCM_PROJECT_ID"] = "vex-test";
-        try {
-            const { db } = createSpireHarness([], [fcmSubscription]);
-            const service = new NotificationService(db, [], () => {});
-
-            await service["notifyPush"]({
-                data: {
-                    callID: "call-fcm",
-                    expiresAt: "2026-06-05T12:01:00.000Z",
-                    mailID: "mail-fcm",
-                    mailNonce: "beef",
-                },
-                deviceID: fcmSubscription.deviceID,
-                event: "callWake",
-                transmissionID: "00000000-0000-0000-0000-000000000018",
-                userID: fcmSubscription.userID,
-            });
-        } finally {
-            delete process.env["SPIRE_FCM_CLIENT_EMAIL"];
-            delete process.env["SPIRE_FCM_PRIVATE_KEY"];
-            delete process.env["SPIRE_FCM_PROJECT_ID"];
-        }
-
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-        expect(fetchMock.mock.calls[0]?.[0]).toBe(
-            "https://oauth2.googleapis.com/token",
-        );
-        expect(fetchMock.mock.calls[1]?.[0]).toBe(
-            "https://fcm.googleapis.com/v1/projects/vex-test/messages:send",
-        );
-        const init = fetchMock.mock.calls[1]?.[1] as
-            | undefined
-            | { body?: unknown };
-        const body = JSON.parse(String(init?.body)) as {
-            message?: {
-                android?: { priority?: string; ttl?: string };
-                data?: Record<string, string>;
-                token?: string;
-            };
-        };
-        expect(body.message?.token).toBe("fcm-token");
-        expect(body.message?.android?.priority).toBe("HIGH");
-        expect(body.message?.data).toMatchObject({
-            callID: "call-fcm",
-            event: "callWake",
-            mailID: "mail-fcm",
-            mailNonce: "beef",
-            transmissionID: "00000000-0000-0000-0000-000000000018",
-        });
-        expect(body.message?.data).not.toHaveProperty("callerUserID");
-        expect(body.message?.data).not.toHaveProperty("sdp");
-    });
-
     it("requests the default sound for iOS visible Expo pushes only", async () => {
         const iosSubscription: NotificationSubscription = {
             ...subscription,

package/src/db/schema.ts

@@ -8,6 +8,63 @@ import type { Insertable, Selectable, Updateable } from "kysely";
 
 // ── Table interfaces ────────────────────────────────────────────────────
 
+export type AccountEntitlementRow = Selectable<AccountEntitlementsTable>;
+
+export interface AccountEntitlementsTable {
+    expiresAt: null | string;
+    source: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+
+export type AccountEntitlementUpdate = Updateable<AccountEntitlementsTable>;
+
+export type BillingStoreSubscriptionRow =
+    Selectable<BillingStoreSubscriptionsTable>;
+
+export interface BillingStoreSubscriptionsTable {
+    createdAt: string;
+    environment: string;
+    expiresAt: null | string;
+    externalOriginalID: null | string;
+    externalTransactionID: null | string;
+    platform: string;
+    productID: string;
+    purchaseToken: null | string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    status: string;
+    storeProductID: string;
+    subscriptionID: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+
+export type BillingStoreSubscriptionUpdate =
+    Updateable<BillingStoreSubscriptionsTable>;
+
+export type BillingStoreTransactionRow =
+    Selectable<BillingStoreTransactionsTable>;
+
+export interface BillingStoreTransactionsTable {
+    environment: string;
+    eventType: string;
+    externalTransactionID: null | string;
+    platform: string;
+    processedAt: string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    storeProductID: string;
+    subscriptionID: string;
+    transactionID: string;
+    userID: string;
+}
+
+export type BillingStoreTransactionUpdate =
+    Updateable<BillingStoreTransactionsTable>;
+
 export type ChannelRow = Selectable<ChannelsTable>;
 
 export interface ChannelsTable {
@@ -92,8 +149,13 @@ export interface MailTable {
     time: string;
 }
 export type MailUpdate = Updateable<MailTable>;
-export type NewChannel = Insertable<ChannelsTable>;
+export type NewAccountEntitlement = Insertable<AccountEntitlementsTable>;
+export type NewBillingStoreSubscription =
+    Insertable<BillingStoreSubscriptionsTable>;
+export type NewBillingStoreTransaction =
+    Insertable<BillingStoreTransactionsTable>;
 
+export type NewChannel = Insertable<ChannelsTable>;
 export type NewDevice = Insertable<DevicesTable>;
 export type NewDevicePasskeyApproval = Insertable<DevicePasskeyApprovalsTable>;
 export type NewEmoji = Insertable<EmojisTable>;
@@ -177,6 +239,9 @@ export interface PreKeysTable {
 }
 export type PreKeyUpdate = Updateable<PreKeysTable>;
 export interface ServerDatabase {
+    account_entitlements: AccountEntitlementsTable;
+    billing_store_subscriptions: BillingStoreSubscriptionsTable;
+    billing_store_transactions: BillingStoreTransactionsTable;
     channels: ChannelsTable;
     device_passkey_approvals: DevicePasskeyApprovalsTable;
     devices: DevicesTable;

package/src/migrations/2026-06-24_account-entitlements.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("account_entitlements").ifExists().execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createTable("account_entitlements")
+        .ifNotExists()
+        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("tier", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("source", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("expiresAt", "text")
+        .addColumn("updatedAt", "text", (cb) => cb.notNull())
+        .execute();
+}