@vex-chat/spire 2.6.0 → 3.0.1

package/src/Spire.ts

@@ -53,7 +53,6 @@ import {
     MailIngressValidationError,
     validateMailIngress,
 } from "./server/mailIngress.ts";
-import { passkeySecondFactorError } from "./server/passkeySecondFactor.ts";
 import { authLimiter, devApiKeySkipsRateLimits } from "./server/rateLimit.ts";
 import { createPendingDeviceEnrollmentRequest } from "./server/user.ts";
 import { censorUser, getParam, getUser } from "./server/utils.ts";
@@ -62,8 +61,6 @@ import { getJwtSecret } from "./utils/jwtSecret.ts";
 import { msgpack } from "./utils/msgpack.ts";
 import { spireXSignOpenAsync } from "./utils/spireXSignOpenAsync.ts";
 
-export { passkeySecondFactorError } from "./server/passkeySecondFactor.ts";
-
 // expiry of regkeys = 24hr
 export const TOKEN_EXPIRY = 1000 * 60 * 10;
 export const JWT_EXPIRY = "7d";
@@ -797,22 +794,6 @@ export class Spire extends EventEmitter {
                         .send({ error: "Device owner not found." });
                 }
 
-                const passkeyError = await passkeySecondFactorError(
-                    this.db,
-                    user.userID,
-                    req.passkey?.passkeyID,
-                    "Passkey verification does not match this device.",
-                );
-                if (passkeyError) {
-                    const body: { error: string; username?: string } = {
-                        error: passkeyError,
-                    };
-                    if (passkeyError === "Passkey verification required.") {
-                        body.username = user.username;
-                    }
-                    return res.status(403).send(body);
-                }
-
                 // Issue short-lived JWT (1 hour, not 7 days)
                 const token = jwt.sign(
                     { user: censorUser(user) },
@@ -1109,19 +1090,6 @@ export class Spire extends EventEmitter {
                     await this.db.rehashPassword(userEntry.userID, newHash);
                 }
 
-                const passkeyError = await passkeySecondFactorError(
-                    this.db,
-                    userEntry.userID,
-                    req.passkey?.passkeyID,
-                    "Passkey verification does not match this account.",
-                );
-                if (passkeyError) {
-                    res.status(403).send({
-                        error: passkeyError,
-                    });
-                    return;
-                }
-
                 const token = jwt.sign(
                     { user: censorUser(userEntry) },
                     getJwtSecret(),
@@ -1181,6 +1149,88 @@ export class Spire extends EventEmitter {
                         TokenScopes.Register,
                     )
                 ) {
+                    const existingUser = await this.db.retrieveUser(
+                        normalizedPayload.username,
+                    );
+                    if (existingUser) {
+                        const existingBySignKey = await this.db.retrieveDevice(
+                            normalizedPayload.signKey,
+                        );
+                        if (existingBySignKey) {
+                            res.status(400).send({
+                                error: "Public key is already registered.",
+                            });
+                            return;
+                        }
+                        let requesterPasskeyID: string | undefined;
+                        if (req.passkey?.passkeyID) {
+                            const passkey =
+                                await this.db.retrievePasskeyInternal(
+                                    req.passkey.passkeyID,
+                                );
+                            if (
+                                !passkey ||
+                                passkey.userID !== existingUser.userID
+                            ) {
+                                res.status(403).send({
+                                    error: "Passkey verification does not match this account.",
+                                });
+                                return;
+                            }
+                            requesterPasskeyID = req.passkey.passkeyID;
+                        } else {
+                            if (
+                                typeof normalizedPayload.password !==
+                                    "string" ||
+                                normalizedPayload.password.trim().length === 0
+                            ) {
+                                res.status(401).send({
+                                    error: "Password is required to add this device.",
+                                });
+                                return;
+                            }
+                            const { needsRehash, valid } = await verifyPassword(
+                                normalizedPayload.password,
+                                existingUser,
+                            );
+                            if (!valid) {
+                                res.sendStatus(401);
+                                return;
+                            }
+                            if (needsRehash) {
+                                const newHash = await hashPasswordArgon2(
+                                    normalizedPayload.password,
+                                );
+                                await this.db.rehashPassword(
+                                    existingUser.userID,
+                                    newHash,
+                                );
+                            }
+                        }
+                        const pendingResponse =
+                            createPendingDeviceEnrollmentRequest(
+                                existingUser.userID,
+                                normalizedPayload,
+                                this.notify.bind(this),
+                                {
+                                    deferOwnerNotification: true,
+                                    ...(requesterPasskeyID
+                                        ? { requesterPasskeyID }
+                                        : {}),
+                                },
+                            );
+                        res.status(202).send(msgpack.encode(pendingResponse));
+                        return;
+                    }
+                    if (
+                        typeof normalizedPayload.password !== "string" ||
+                        normalizedPayload.password.trim().length === 0
+                    ) {
+                        res.status(400).send({
+                            error: "Password is required to register a new account.",
+                        });
+                        return;
+                    }
                     const [user, err] = await this.db.createUser(
                         regKey,
                         normalizedPayload,
@@ -1202,57 +1252,9 @@ export class Spire extends EventEmitter {
                             errCode === "SQLITE_CONSTRAINT_UNIQUE" ||
                             errText.includes("UNIQUE constraint failed");
                         if (isUniqueConstraint && usernameConflict) {
-                            const existingUser = await this.db.retrieveUser(
-                                normalizedPayload.username,
-                            );
-                            if (!existingUser) {
-                                res.status(400).send({
-                                    error: "Username is already registered.",
-                                });
-                                return;
-                            }
-                            const existingBySignKey =
-                                await this.db.retrieveDevice(
-                                    normalizedPayload.signKey,
-                                );
-                            if (existingBySignKey) {
-                                res.status(400).send({
-                                    error: "Public key is already registered.",
-                                });
-                                return;
-                            }
-                            let requesterPasskeyID: string | undefined;
-                            if (req.passkey?.passkeyID) {
-                                const passkeyError =
-                                    await passkeySecondFactorError(
-                                        this.db,
-                                        existingUser.userID,
-                                        req.passkey.passkeyID,
-                                        "Passkey verification does not match this account.",
-                                    );
-                                if (passkeyError) {
-                                    res.status(403).send({
-                                        error: passkeyError,
-                                    });
-                                    return;
-                                }
-                                requesterPasskeyID = req.passkey.passkeyID;
-                            }
-                            const pendingResponse =
-                                createPendingDeviceEnrollmentRequest(
-                                    existingUser.userID,
-                                    normalizedPayload,
-                                    this.notify.bind(this),
-                                    {
-                                        deferOwnerNotification: true,
-                                        ...(requesterPasskeyID
-                                            ? { requesterPasskeyID }
-                                            : {}),
-                                    },
-                                );
-                            res.status(202).send(
-                                msgpack.encode(pendingResponse),
-                            );
+                            res.status(400).send({
+                                error: "Username is already registered.",
+                            });
                             return;
                         }
                         if (isUniqueConstraint && signKeyConflict) {

package/src/__tests__/Database.spec.ts

@@ -81,6 +81,36 @@ describe("Database", () => {
         dbType: "sqlite3mem",
     };
 
+    describe("createUser", () => {
+        it("requires a password for new accounts", async () => {
+            expect.assertions(3);
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const [user, err] = await provider.createUser(
+                                new Uint8Array(16),
+                                devicePayload("desktop", "b".repeat(64)),
+                            );
+                            expect(user).toBeNull();
+                            expect(err).toBeInstanceOf(Error);
+                            expect(err?.message).toBe(
+                                "Password is required to register a new account.",
+                            );
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
     describe("saveOTK", () => {
         it("takes a userId and one time key, adds a keyId and saves it to oneTimeKey table", async () => {
             expect.assertions(1);

package/src/__tests__/connectAuth.spec.ts

@@ -0,0 +1,120 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { xSignAsync, xSignKeyPair, XUtils } from "@vex-chat/crypto";
+import { TokenScopes } from "@vex-chat/types";
+
+import jwt from "jsonwebtoken";
+import { parse as uuidParse } from "uuid";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { initApp } from "../server/index.ts";
+import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { msgpack } from "../utils/msgpack.ts";
+
+const originalJwtSecret = process.env["JWT_SECRET"];
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+describe("device connect auth", () => {
+    afterEach(() => {
+        if (originalJwtSecret === undefined) {
+            delete process.env["JWT_SECRET"];
+        } else {
+            process.env["JWT_SECRET"] = originalJwtSecret;
+        }
+    });
+
+    it("allows a password-created account to connect before passkey enrollment", async () => {
+        process.env["JWT_SECRET"] = "test-jwt-secret";
+        const connectToken = "93ce482b-a0f2-4f6e-b1df-3aed61073552";
+        const signKeys = xSignKeyPair();
+        const device: Device = {
+            deleted: false,
+            deviceID: "device-a",
+            lastLogin: new Date(0).toISOString(),
+            name: "desktop",
+            owner: user.userID,
+            signKey: XUtils.encodeHex(signKeys.publicKey),
+        };
+        const db = {
+            retrieveDevice: (deviceID: string) =>
+                Promise.resolve(deviceID === device.deviceID ? device : null),
+        } as unknown as Database;
+        const app = express();
+        initApp(
+            app,
+            db,
+            (key, scope) =>
+                key === connectToken && scope === TokenScopes.Connect,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const signed = await xSignAsync(
+                Uint8Array.from(uuidParse(connectToken)),
+                signKeys.secretKey,
+            );
+            const token = jwt.sign({ user }, getJwtSecret());
+
+            const res = await fetch(
+                `http://127.0.0.1:${String(address.port)}/device/${device.deviceID}/connect`,
+                {
+                    body: msgpack.encode({ signed }),
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        "Content-Type": "application/msgpack",
+                    },
+                    method: "POST",
+                },
+            );
+
+            expect(res.status).toBe(200);
+            const body = msgpack.decode(
+                new Uint8Array(await res.arrayBuffer()),
+            ) as { deviceToken?: unknown };
+            expect(typeof body.deviceToken).toBe("string");
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((err) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}

package/src/__tests__/passkeys.spec.ts

@@ -9,7 +9,6 @@ import type { SpireOptions } from "../Spire.ts";
 import { describe, expect, it, vi } from "vitest";
 
 import { Database } from "../Database.ts";
-import { passkeySecondFactorError } from "../Spire.ts";
 
 vi.mock("uuid", () => ({
     parse: (s: string) => {
@@ -203,52 +202,9 @@ describe("Database passkeys", () => {
         });
     });
 
-    describe("passkeySecondFactorError", () => {
-        it("allows bootstrap login when the account has no passkeys", async () => {
+    describe("device passkey approval records", () => {
+        it("records passkey-backed device approval metadata", async () => {
             expect.assertions(1);
-            await withDb(async (db) => {
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBeNull();
-            });
-        });
-
-        it("requires a matching passkey once the account has one", async () => {
-            expect.assertions(3);
-            await withDb(async (db) => {
-                const created = await db.createPasskey(
-                    userID,
-                    samplePasskey.name,
-                    samplePasskey.credentialID,
-                    samplePasskey.publicKeyHex,
-                    samplePasskey.algorithm,
-                    samplePasskey.transports,
-                );
-
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
-                await expect(
-                    passkeySecondFactorError(
-                        db,
-                        userID,
-                        "not-this-passkey",
-                        "mismatch",
-                    ),
-                ).resolves.toBe("mismatch");
-                await expect(
-                    passkeySecondFactorError(
-                        db,
-                        userID,
-                        created.passkeyID,
-                        "mismatch",
-                    ),
-                ).resolves.toBeNull();
-            });
-        });
-
-        it("does not treat device approval as future passkey verification", async () => {
-            expect.assertions(3);
             await withDb(async (db) => {
                 const created = await db.createPasskey(
                     userID,
@@ -264,15 +220,9 @@ describe("Database passkeys", () => {
                     { approvedByPasskeyID: created.passkeyID },
                 );
 
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
                 await expect(
                     db.isDevicePasskeyApproved(userID, device.deviceID),
                 ).resolves.toBe(true);
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
             });
         });
 

package/src/server/cliPasskeyPage.ts

@@ -167,7 +167,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
 
         if (mode === "register") {
             titleEl.textContent = "Create a passkey for Vex.";
-            copyEl.textContent = "This adds the first passkey required by your new CLI account.";
+            copyEl.textContent = "This adds a passkey to your Vex account.";
             action.textContent = "Create passkey";
             setStatus("Ready to create passkey.");
         } else {

package/src/server/index.ts

@@ -46,11 +46,7 @@ import {
     hasPermission,
     userHasPermission,
 } from "./permissions.ts";
-import {
-    devApiKeyMatches,
-    globalLimiter,
-    keyBundleLimiter,
-} from "./rateLimit.ts";
+import { globalLimiter, keyBundleLimiter } from "./rateLimit.ts";
 import { getUserRouter } from "./user.ts";
 import { censorUser, getParam, getUser } from "./utils.ts";
 import { getWellKnownRouter } from "./wellKnown.ts";
@@ -688,17 +684,6 @@ export const initApp = (
             res.sendStatus(401);
             return;
         }
-        const passkeys = await db.retrievePasskeysByUser(device.owner);
-        // The CLI stress harness cannot perform a WebAuthn ceremony.
-        // Keep normal clients gated, but let the existing dev/load-test key
-        // exercise device connect on disposable accounts.
-        if (passkeys.length === 0 && !devApiKeyMatches(req)) {
-            res.status(403).send({
-                error: "A passkey must be registered before this device can connect.",
-            });
-            return;
-        }
-
         const regKey = await spireXSignOpenAsync(
             signed,
             XUtils.decodeHex(device.signKey),

package/src/server/passkey.ts

@@ -204,10 +204,9 @@ export const getPasskeyRouter = (db: Database) => {
             }
 
             const existing = await db.retrievePasskeysByUser(userID);
-            // A freshly registered account has a bearer token but cannot
-            // get a device token until its first passkey exists. Allow
-            // exactly that bootstrap case; every later passkey addition
-            // must come from an authenticated device session.
+            // A freshly registered account may add its first passkey with
+            // the account bearer before finishing device connect. Every later
+            // passkey addition must come from an authenticated device session.
             if (!req.device && existing.length > 0) {
                 res.status(401).send({
                     error: "Adding another passkey requires an authenticated device.",
@@ -408,13 +407,6 @@ export const getPasskeyRouter = (db: Database) => {
                 res.sendStatus(404);
                 return;
             }
-            const passkeys = await db.retrievePasskeysByUser(userID);
-            if (passkeys.length <= 1) {
-                res.status(400).send({
-                    error: "You can't delete your last passkey.",
-                });
-                return;
-            }
             await db.deletePasskey(passkeyID);
             res.sendStatus(200);
         },

package/src/server/user.ts

@@ -28,7 +28,6 @@ import { msgpack } from "../utils/msgpack.ts";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.ts";
 
 import { AppError } from "./errors.ts";
-import { passkeySecondFactorError } from "./passkeySecondFactor.ts";
 import { censorUser, getParam, getUser } from "./utils.ts";
 import { buildAndroidApkKeyHashOrigins } from "./wellKnown.ts";
 
@@ -914,14 +913,13 @@ export const getUserRouter = (
 
             let requesterPasskeyID: string | undefined;
             if (req.passkey?.passkeyID) {
-                const passkeyError = await passkeySecondFactorError(
-                    db,
-                    userDetails.userID,
+                const passkey = await db.retrievePasskeyInternal(
                     req.passkey.passkeyID,
-                    "Passkey verification does not match this account.",
                 );
-                if (passkeyError) {
-                    res.status(403).send({ error: passkeyError });
+                if (!passkey || passkey.userID !== userDetails.userID) {
+                    res.status(403).send({
+                        error: "Passkey verification does not match this account.",
+                    });
                     return;
                 }
                 requesterPasskeyID = req.passkey.passkeyID;
@@ -1032,15 +1030,15 @@ export const getUserRouter = (
             // Older clients may still satisfy this with an approval-side passkey.
             const approvedByPasskeyID =
                 pending.requesterPasskeyID ?? req.passkey?.passkeyID;
-            const passkeyError = await passkeySecondFactorError(
-                db,
-                userID,
-                approvedByPasskeyID,
-                "Passkey verification does not match this account.",
-            );
-            if (passkeyError) {
-                res.status(403).send({ error: passkeyError });
-                return;
+            if (approvedByPasskeyID) {
+                const passkey =
+                    await db.retrievePasskeyInternal(approvedByPasskeyID);
+                if (!passkey || passkey.userID !== userID) {
+                    res.status(403).send({
+                        error: "Passkey verification does not match this account.",
+                    });
+                    return;
+                }
             }
 
             const opened = await spireXSignOpenAsync(

package/dist/server/passkeySecondFactor.d.ts

@@ -1,7 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-import type { Database } from "../Database.ts";
-export declare function passkeySecondFactorError(db: Database, userID: string, passkeyID: string | undefined, mismatchError: string): Promise<null | string>;

package/dist/server/passkeySecondFactor.js

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-export async function passkeySecondFactorError(db, userID, passkeyID, mismatchError) {
-    const passkeys = await db.retrievePasskeysByUser(userID);
-    if (passkeys.length === 0) {
-        return null;
-    }
-    if (!passkeyID) {
-        return "Passkey verification required.";
-    }
-    const passkey = await db.retrievePasskeyInternal(passkeyID);
-    if (!passkey || passkey.userID !== userID) {
-        return mismatchError;
-    }
-    return null;
-}
-//# sourceMappingURL=passkeySecondFactor.js.map

package/dist/server/passkeySecondFactor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeySecondFactor.js","sourceRoot":"","sources":["../../src/server/passkeySecondFactor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,EAAY,EACZ,MAAc,EACd,SAA6B,EAC7B,aAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,gCAAgC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/src/server/passkeySecondFactor.ts

@@ -1,27 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-
-import type { Database } from "../Database.ts";
-
-export async function passkeySecondFactorError(
-    db: Database,
-    userID: string,
-    passkeyID: string | undefined,
-    mismatchError: string,
-): Promise<null | string> {
-    const passkeys = await db.retrievePasskeysByUser(userID);
-    if (passkeys.length === 0) {
-        return null;
-    }
-    if (!passkeyID) {
-        return "Passkey verification required.";
-    }
-    const passkey = await db.retrievePasskeyInternal(passkeyID);
-    if (!passkey || passkey.userID !== userID) {
-        return mismatchError;
-    }
-    return null;
-}