@vex-chat/spire 3.0.0 → 4.0.0

package/README.md

@@ -72,14 +72,15 @@ Spire reads configuration from environment variables. **Docker Compose:** put th
 
 ### Optional
 
-| Variable       | Default    | Description                                                                                                                                                                                                                                                                                                                                                                                            |
-| -------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `SPIRE_FIPS`   | _falsy_    | If `true` or `1`, run the **FIPS** profile (P-256, Web Crypto). `SPK` must come from `pnpm --filter @vex-chat/spire gen-spk-fips`, not `gen-spk`. Any other value uses **tweetnacl** (Ed25519) and `gen-spk`. In Docker Compose, the service passes `SPIRE_FIPS=${SPIRE_FIPS:-false}` so the shell or `.env` can set the mode.                                                                         |
-| `API_PORT`     | (see text) | If unset, Spire listens on **16777** (all crypto profiles; use `GET /status` to see which). In Docker, nginx and the image healthcheck use `deploy/resolve-spire-listen-port.sh` to follow the same rule. Set explicitly to override.                                                                                                                                                                  |
-| `NODE_ENV`     | _(unset)_  | Set to `production` to disable interactive `/docs` / `/async-docs`. If unset or any other value, doc viewers are mounted. `helmet()` runs in all modes.                                                                                                                                                                                                                                                |
-| `CORS_ORIGINS` | _(empty)_  | Comma-separated allowed `Origin` values. If set, only those origins may use credentialed browser requests. If unset, Spire **reflects the request `Origin`** so self-hosted Spire and arbitrary app origins (Tauri, localhost, etc.) work without configuration — appropriate for bearer-token APIs; set an allowlist if you need to restrict which sites may call your instance from users' browsers. |
-| `DEV_API_KEY`  | _(empty)_  | When set, requests that send header `x-dev-api-key` with the same value (constant-time compare) **skip in-process rate limiters**. The same gate enables **`GET /status/process`** (404 without a valid key): a small JSON snapshot of the Spire Node process (PID, uptime, `memoryUsage`, cumulative `resourceUsage`, WebSocket client count). Dev / load-testing only — never set in production.     |
-| `CANARY`       | _(unset)_  |                                                                                                                                                                                                                                                                                                                                                                                                        |
+| Variable                 | Default    | Description                                                                                                                                                                                                                                                                                                                                                                                        |
+| ------------------------ | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SPIRE_FIPS`             | _falsy_    | If `true` or `1`, run the **FIPS** profile (P-256, Web Crypto). `SPK` must come from `pnpm --filter @vex-chat/spire gen-spk-fips`, not `gen-spk`. Any other value uses **tweetnacl** (Ed25519) and `gen-spk`. In Docker Compose, the service passes `SPIRE_FIPS=${SPIRE_FIPS:-false}` so the shell or `.env` can set the mode.                                                                     |
+| `API_PORT`               | (see text) | If unset, Spire listens on **16777** (all crypto profiles; use `GET /status` to see which). In Docker, nginx and the image healthcheck use `deploy/resolve-spire-listen-port.sh` to follow the same rule. Set explicitly to override.                                                                                                                                                              |
+| `NODE_ENV`               | _(unset)_  | Set to `production` to disable interactive `/docs` / `/async-docs`. If unset or any other value, doc viewers are mounted. `helmet()` runs in all modes.                                                                                                                                                                                                                                            |
+| `CORS_ORIGINS`           | _(empty)_  | Comma-separated allowed `Origin` values. In production, an empty value rejects cross-origin browser requests; same-origin and native clients are unaffected. Development permits only localhost, loopback, Tauri, and Capacitor origins when unset.                                                                                                                                                |
+| `SPIRE_TRUST_PROXY_HOPS` | `0`        | Number of trusted reverse-proxy hops. Set `1` for the bundled single-nginx topology. This must match the real network path so clients cannot spoof `X-Forwarded-For` to evade IP rate limits.                                                                                                                                                                                                      |
+| `DEV_API_KEY`            | _(empty)_  | When set, requests that send header `x-dev-api-key` with the same value (constant-time compare) **skip in-process rate limiters**. The same gate enables **`GET /status/process`** (404 without a valid key): a small JSON snapshot of the Spire Node process (PID, uptime, `memoryUsage`, cumulative `resourceUsage`, WebSocket client count). Dev / load-testing only — never set in production. |
+| `CANARY`                 | _(unset)_  |                                                                                                                                                                                                                                                                                                                                                                                                    |
 
 ### Passkeys / WebAuthn
 

package/dist/Database.d.ts

@@ -28,10 +28,8 @@ export interface StoreTransactionRecordInput {
     subscriptionID: string;
     userID: string;
 }
-/** Internal record that includes the hash algorithm discriminator. */
-export interface InternalUserRecord extends UserRecord {
-    hashAlgo: string;
-}
+export declare const MAX_ACTIVE_DEVICES_PER_USER = 20;
+export type InternalUserRecord = UserRecord;
 export interface NotificationSubscription {
     channel: "expo";
     createdAt: string;
@@ -117,7 +115,7 @@ export declare class Database extends EventEmitter {
      * WebAuthn spec (FIDO authenticators that report 0 signal they
      * don't track a counter — callers should treat 0→0 as legitimate).
      */
-    markPasskeyUsed(passkeyID: string, signCount: number): Promise<void>;
+    markPasskeyUsed(passkeyID: string, expectedSignCount: number, signCount: number): Promise<boolean>;
     markUserSeen(user: UserRecord): Promise<void>;
     /** Deletes server-side mail older than the configured retention window. */
     pruneExpiredMail(): Promise<void>;
@@ -216,6 +214,7 @@ export declare class Database extends EventEmitter {
     upsertStoreSubscription(input: StoreSubscriptionUpsertInput): Promise<BillingSubscription>;
     private findExistingStoreSubscription;
     private init;
+    private insertDevice;
     private mailSqlEntry;
 }
 /**
@@ -224,14 +223,16 @@ export declare class Database extends EventEmitter {
  */
 export declare function hashPasswordArgon2(password: string): Promise<string>;
 /**
- * Verify a password against either Argon2id or legacy PBKDF2 storage.
- * Returns `{ valid, needsRehash }` — callers should rehash on success
- * when `needsRehash` is true.
+ * Validate new account passwords without imposing composition rules. Passwords
+ * are hashed exactly as supplied; normalization is used only for comparisons
+ * against account-specific and common-password deny lists.
+ */
+export declare function validateAccountPassword(password: string, username?: string): null | string;
+/**
+ * Verify an Argon2id password hash. Unknown hash formats fail closed.
  */
-export declare function verifyPassword(password: string, stored: {
-    hashAlgo: string;
+export declare function verifyPassword(password: string, stored: null | {
     passwordHash: string;
-    passwordSalt: string;
 }): Promise<{
     needsRehash: boolean;
     valid: boolean;

package/dist/Database.js

@@ -12,13 +12,13 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { EventEmitter } from "events";
-import { createHash, pbkdf2Sync } from "node:crypto";
+import { createHash } from "node:crypto";
 import { statSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { fipsEcdhRawPublicKeyFromEcdsaSpkiAsync, getCryptoProfile, XUtils, } from "@vex-chat/crypto";
-import { AccountEntitlementSourceSchema, AccountTierSchema, BillingEnvironmentSchema, BillingPlatformSchema, BillingSubscriptionStatusSchema, buildAccountEntitlements, MailType, } from "@vex-chat/types";
+import { ACCOUNT_PASSWORD_MAX_LENGTH, ACCOUNT_PASSWORD_MIN_LENGTH, AccountEntitlementSourceSchema, AccountTierSchema, BillingEnvironmentSchema, BillingPlatformSchema, BillingSubscriptionStatusSchema, buildAccountEntitlements, MailType, } from "@vex-chat/types";
 import argon2 from "argon2";
 import { serverMailRetentionCutoffIso } from "./mailRetention.js";
 /**
@@ -38,6 +38,7 @@ function parseMailType(n) {
 import BetterSqlite3 from "better-sqlite3";
 import { Kysely, Migrator, sql, SqliteDialect } from "kysely";
 import { stringify as uuidStringify, validate as uuidValidate } from "uuid";
+export const MAX_ACTIVE_DEVICES_PER_USER = 20;
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const migrationFolder = path.join(__dirname, "migrations");
 /**
@@ -86,9 +87,22 @@ function isMigration(mod) {
         "up" in mod &&
         typeof mod.up === "function");
 }
-const pubkeyRegex = /[0-9a-f]{64}/;
-/** Legacy iteration count kept only for verifying old PBKDF2 hashes. */
-const PBKDF2_ITERATIONS = 1000;
+const pubkeyRegex = /^(?:[0-9a-fA-F]{2}){32,4096}$/;
+const DUMMY_PASSWORD_HASH = "$argon2id$v=19$m=65536,t=3,p=1$SZlCYiWwt450ZWt2zRvDIw$QZdY/EtG81hEAXYRLVDvqtpJbajXL1/QRM91ZT9DQPk";
+const ARGON2_OPTIONS = {
+    memoryCost: 65_536,
+    parallelism: 1,
+    timeCost: 3,
+    type: argon2.argon2id,
+};
+const COMMON_ACCOUNT_PASSWORDS = new Set([
+    "123456789012345",
+    "adminadminadminadmin",
+    "letmeinletmeinletmein",
+    "passwordpassword",
+    "passwordpasswordpassword",
+    "qwertyuiopasdfgh",
+]);
 export class Database extends EventEmitter {
     static EMOJI_LIST_CACHE_TTL_MS = 10_000;
     db;
@@ -143,46 +157,9 @@ export class Database extends EventEmitter {
         return channel;
     }
     async createDevice(owner, payload, passkeyApproval) {
-        const now = new Date().toISOString();
-        const device = {
-            deleted: 0,
-            deviceID: crypto.randomUUID(),
-            lastLogin: now,
-            name: payload.deviceName,
-            owner,
-            signKey: payload.signKey,
-        };
-        const medPreKeys = {
-            deviceID: device.deviceID,
-            index: payload.preKeyIndex,
-            keyID: crypto.randomUUID(),
-            publicKey: payload.preKey,
-            signature: payload.preKeySignature,
-            userID: owner,
-        };
-        await this.db.transaction().execute(async (trx) => {
-            await trx.insertInto("devices").values(device).execute();
-            await trx.insertInto("preKeys").values(medPreKeys).execute();
-            if (passkeyApproval) {
-                await trx
-                    .insertInto("device_passkey_approvals")
-                    .values({
-                    approvedAt: now,
-                    approvedByDeviceID: passkeyApproval.approvedByDeviceID ?? null,
-                    approvedByPasskeyID: passkeyApproval.approvedByPasskeyID,
-                    deviceID: device.deviceID,
-                    userID: owner,
-                })
-                    .onConflict((oc) => oc.column("deviceID").doUpdateSet({
-                    approvedAt: now,
-                    approvedByDeviceID: passkeyApproval.approvedByDeviceID ?? null,
-                    approvedByPasskeyID: passkeyApproval.approvedByPasskeyID,
-                    userID: owner,
-                }))
-                    .execute();
-            }
-        });
-        return toDevice(device);
+        return this.db
+            .transaction()
+            .execute(async (trx) => this.insertDevice(trx, owner, payload, passkeyApproval));
     }
     async createEmoji(emoji) {
         await this.db.insertInto("emojis").values(emoji).execute();
@@ -284,28 +261,32 @@ export class Database extends EventEmitter {
     async createUser(regKey, regPayload) {
         try {
             const userID = uuidStringify(regKey);
-            const username = normalizeRegistrationUsername(regPayload.username, userID);
+            const username = normalizeRegistrationUsername(regPayload.username);
             if (typeof regPayload.password !== "string" ||
                 regPayload.password.trim().length === 0) {
                 throw new Error("Password is required to register a new account.");
             }
+            const passwordError = validateAccountPassword(regPayload.password, username);
+            if (passwordError) {
+                throw new Error(passwordError);
+            }
             const passwordHash = await hashPasswordArgon2(regPayload.password);
             const user = {
                 lastSeen: new Date().toISOString(),
                 passwordHash,
-                passwordSalt: "",
                 userID,
                 username,
             };
-            await this.db
-                .insertInto("users")
-                .values({
-                ...user,
-                hashAlgo: "argon2id",
-                lastSeen: user.lastSeen,
-            })
-                .execute();
-            await this.createDevice(user.userID, regPayload);
+            await this.db.transaction().execute(async (trx) => {
+                await trx
+                    .insertInto("users")
+                    .values({
+                    ...user,
+                    lastSeen: user.lastSeen,
+                })
+                    .execute();
+                await this.insertDevice(trx, user.userID, regPayload);
+            });
             return [user, null];
         }
         catch (err) {
@@ -324,27 +305,29 @@ export class Database extends EventEmitter {
             .execute();
     }
     async deleteDevice(deviceID) {
-        await this.db
-            .deleteFrom("preKeys")
-            .where("deviceID", "=", deviceID)
-            .execute();
-        await this.db
-            .deleteFrom("oneTimeKeys")
-            .where("deviceID", "=", deviceID)
-            .execute();
-        await this.db
-            .deleteFrom("notification_subscriptions")
-            .where("deviceID", "=", deviceID)
-            .execute();
-        await this.db
-            .deleteFrom("device_passkey_approvals")
-            .where("deviceID", "=", deviceID)
-            .execute();
-        await this.db
-            .updateTable("devices")
-            .set({ deleted: 1 })
-            .where("deviceID", "=", deviceID)
-            .execute();
+        await this.db.transaction().execute(async (trx) => {
+            await trx
+                .deleteFrom("preKeys")
+                .where("deviceID", "=", deviceID)
+                .execute();
+            await trx
+                .deleteFrom("oneTimeKeys")
+                .where("deviceID", "=", deviceID)
+                .execute();
+            await trx
+                .deleteFrom("notification_subscriptions")
+                .where("deviceID", "=", deviceID)
+                .execute();
+            await trx
+                .deleteFrom("device_passkey_approvals")
+                .where("deviceID", "=", deviceID)
+                .execute();
+            await trx
+                .updateTable("devices")
+                .set({ deleted: 1 })
+                .where("deviceID", "=", deviceID)
+                .execute();
+        });
     }
     async deleteEmoji(emojiID) {
         const existing = await this.retrieveEmoji(emojiID);
@@ -598,15 +581,17 @@ export class Database extends EventEmitter {
      * WebAuthn spec (FIDO authenticators that report 0 signal they
      * don't track a counter — callers should treat 0→0 as legitimate).
      */
-    async markPasskeyUsed(passkeyID, signCount) {
-        await this.db
+    async markPasskeyUsed(passkeyID, expectedSignCount, signCount) {
+        const result = await this.db
             .updateTable("passkeys")
             .set({
             lastUsedAt: new Date().toISOString(),
             signCount,
         })
             .where("passkeyID", "=", passkeyID)
-            .execute();
+            .where("signCount", "=", expectedSignCount)
+            .executeTakeFirst();
+        return Number(result.numUpdatedRows) > 0;
     }
     async markUserSeen(user) {
         await this.db
@@ -761,9 +746,7 @@ export class Database extends EventEmitter {
         await this.db
             .updateTable("users")
             .set({
-            hashAlgo: "argon2id",
             passwordHash: newHash,
-            passwordSalt: "",
         })
             .where("userID", "=", userID)
             .execute();
@@ -1170,13 +1153,8 @@ export class Database extends EventEmitter {
             .executeTakeFirst();
         return row?.userID ?? null;
     }
-    // The identifier is matched as either a userID (UUID branch) or a
-    // username (string branch). Username comparison is case-folded so
-    // `User` and `user` resolve to the same row regardless of how the
-    // caller typed it — the canonical form on disk is lowercase
-    // (`normalizeRegistrationUsername`), but legacy mixed-case rows
-    // from before the canonicalization landed still resolve via the
-    // `lower(username) = lower(?)` predicate below.
+    // The identifier is matched as either a userID or the canonical lowercase
+    // username stored by `normalizeRegistrationUsername`.
     async retrieveUser(userIdentifier) {
         let rows;
         if (uuidValidate(userIdentifier)) {
@@ -1188,11 +1166,11 @@ export class Database extends EventEmitter {
                 .execute();
         }
         else {
-            const normalized = userIdentifier.toLowerCase();
+            const normalized = userIdentifier.trim().toLowerCase();
             rows = await this.db
                 .selectFrom("users")
                 .selectAll()
-                .where(sql `lower(username)`, "=", normalized)
+                .where("username", "=", normalized)
                 .limit(1)
                 .execute();
         }
@@ -1414,6 +1392,55 @@ export class Database extends EventEmitter {
         }
         this.emit("ready");
     }
+    async insertDevice(trx, owner, payload, passkeyApproval) {
+        const activeDeviceCount = await trx
+            .selectFrom("devices")
+            .select((eb) => eb.fn.countAll().as("count"))
+            .where("owner", "=", owner)
+            .where("deleted", "=", 0)
+            .executeTakeFirst();
+        if (Number(activeDeviceCount?.count ?? 0) >= MAX_ACTIVE_DEVICES_PER_USER) {
+            throw new Error(`Each account is limited to ${String(MAX_ACTIVE_DEVICES_PER_USER)} active devices.`);
+        }
+        const now = new Date().toISOString();
+        const device = {
+            deleted: 0,
+            deviceID: crypto.randomUUID(),
+            lastLogin: now,
+            name: payload.deviceName,
+            owner,
+            signKey: payload.signKey,
+        };
+        const medPreKeys = {
+            deviceID: device.deviceID,
+            index: payload.preKeyIndex,
+            keyID: crypto.randomUUID(),
+            publicKey: payload.preKey,
+            signature: payload.preKeySignature,
+            userID: owner,
+        };
+        await trx.insertInto("devices").values(device).execute();
+        await trx.insertInto("preKeys").values(medPreKeys).execute();
+        if (passkeyApproval) {
+            await trx
+                .insertInto("device_passkey_approvals")
+                .values({
+                approvedAt: now,
+                approvedByDeviceID: passkeyApproval.approvedByDeviceID ?? null,
+                approvedByPasskeyID: passkeyApproval.approvedByPasskeyID,
+                deviceID: device.deviceID,
+                userID: owner,
+            })
+                .onConflict((oc) => oc.column("deviceID").doUpdateSet({
+                approvedAt: now,
+                approvedByDeviceID: passkeyApproval.approvedByDeviceID ?? null,
+                approvedByPasskeyID: passkeyApproval.approvedByPasskeyID,
+                userID: owner,
+            }))
+                .execute();
+        }
+        return toDevice(device);
+    }
     mailSqlEntry(mail, header, deviceID, userID, time = new Date().toISOString()) {
         return {
             authorID: userID,
@@ -1438,36 +1465,57 @@ export class Database extends EventEmitter {
  * Returns the encoded hash string which embeds salt, params, and digest.
  */
 export async function hashPasswordArgon2(password) {
-    return argon2.hash(password, {
-        memoryCost: 65536,
-        parallelism: 4,
-        timeCost: 3,
-        type: argon2.argon2id,
-    });
+    if (password.length === 0 ||
+        password.length > ACCOUNT_PASSWORD_MAX_LENGTH) {
+        throw new Error("Password length is outside the supported range.");
+    }
+    return argon2.hash(password, ARGON2_OPTIONS);
 }
 /**
- * Verify a password against either Argon2id or legacy PBKDF2 storage.
- * Returns `{ valid, needsRehash }` — callers should rehash on success
- * when `needsRehash` is true.
+ * Validate new account passwords without imposing composition rules. Passwords
+ * are hashed exactly as supplied; normalization is used only for comparisons
+ * against account-specific and common-password deny lists.
+ */
+export function validateAccountPassword(password, username) {
+    if (password.trim().length === 0 ||
+        password.length < ACCOUNT_PASSWORD_MIN_LENGTH) {
+        return `Password must be at least ${String(ACCOUNT_PASSWORD_MIN_LENGTH)} characters.`;
+    }
+    if (password.length > ACCOUNT_PASSWORD_MAX_LENGTH) {
+        return `Password must be at most ${String(ACCOUNT_PASSWORD_MAX_LENGTH)} characters.`;
+    }
+    const comparable = password.normalize("NFKC").toLowerCase();
+    const comparableUsername = username?.trim().normalize("NFKC").toLowerCase();
+    const characters = Array.from(comparable);
+    const repeatedSingleCharacter = characters.every((character) => character === characters[0]);
+    if (COMMON_ACCOUNT_PASSWORDS.has(comparable) ||
+        repeatedSingleCharacter ||
+        (comparableUsername !== undefined && comparable === comparableUsername)) {
+        return "Choose a less common password.";
+    }
+    return null;
+}
+/**
+ * Verify an Argon2id password hash. Unknown hash formats fail closed.
  */
 export async function verifyPassword(password, stored) {
-    if (stored.hashAlgo === "keycluster") {
+    if (stored === null) {
+        await argon2.verify(DUMMY_PASSWORD_HASH, password);
         return { needsRehash: false, valid: false };
     }
-    if (stored.hashAlgo === "argon2id") {
+    try {
         const valid = await argon2.verify(stored.passwordHash, password);
-        return { needsRehash: false, valid };
+        return {
+            needsRehash: valid &&
+                argon2.needsRehash(stored.passwordHash, ARGON2_OPTIONS),
+            valid,
+        };
     }
-    // Legacy PBKDF2 path
-    const salt = XUtils.decodeHex(stored.passwordSalt);
-    const computed = pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, 32, "sha512");
-    const storedBuf = XUtils.decodeHex(stored.passwordHash);
-    if (computed.length !== storedBuf.length) {
+    catch {
+        // Keep malformed rows on the same expensive path as a missing user.
+        await argon2.verify(DUMMY_PASSWORD_HASH, password).catch(() => false);
         return { needsRehash: false, valid: false };
     }
-    const { timingSafeEqual } = await import("node:crypto");
-    const valid = timingSafeEqual(computed, storedBuf);
-    return { needsRehash: valid, valid };
 }
 function accountTierRank(tier) {
     switch (tier) {
@@ -1530,13 +1578,8 @@ function expiryRank(expiresAt) {
 // flows) gets the same lowercase canonicalization the public
 // `POST /register` route applies. Usernames are case-insensitive at
 // the protocol level.
-function normalizeRegistrationUsername(providedUsername, userID) {
-    const trimmed = providedUsername?.trim().toLowerCase();
-    if (trimmed && trimmed.length > 0) {
-        return trimmed;
-    }
-    const seed = userID.replaceAll("-", "").slice(0, 12);
-    return `key_${seed}`;
+function normalizeRegistrationUsername(providedUsername) {
+    return providedUsername.trim().toLowerCase();
 }
 function parseAccountEntitlementSource(source) {
     const parsed = AccountEntitlementSourceSchema.safeParse(source);