@vex-chat/spire 3.0.0 → 4.0.0

package/src/__tests__/Database.spec.ts

@@ -5,7 +5,7 @@
  */
 
 import type { SpireOptions } from "../Spire.ts";
-import type { DevicePayload, MailWS, PreKeysWS } from "@vex-chat/types";
+import type { MailWS, PreKeysWS, RegistrationPayload } from "@vex-chat/types";
 
 import { XUtils } from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
@@ -13,7 +13,11 @@ import { MailType } from "@vex-chat/types";
 import * as uuid from "uuid";
 import { describe, expect, it, vi } from "vitest";
 
-import { Database } from "../Database.ts";
+import {
+    Database,
+    MAX_ACTIVE_DEVICES_PER_USER,
+    validateAccountPassword,
+} from "../Database.ts";
 
 // vi.mock is hoisted above all imports automatically.
 // Minimal stubs for uuid functions used by spire src: v4, parse, stringify.
@@ -67,8 +71,9 @@ describe("Database", () => {
     const devicePayload = (
         deviceName: string,
         signKey: string,
-    ): DevicePayload => ({
+    ): RegistrationPayload => ({
         deviceName,
+        intent: "create-account",
         preKey: testSQLPreKey.publicKey,
         preKeyIndex: 1,
         preKeySignature: testSQLPreKey.signature,
@@ -81,6 +86,32 @@ describe("Database", () => {
         dbType: "sqlite3mem",
     };
 
+    describe("account password policy", () => {
+        it("accepts long passphrases without composition requirements", () => {
+            expect(
+                validateAccountPassword("four simple words make a password"),
+            ).toBeNull();
+        });
+
+        it("rejects short, common, repeated, and username-matching values", () => {
+            expect(validateAccountPassword("thirteen-char!")).toContain(
+                "at least 15",
+            );
+            expect(validateAccountPassword("passwordpassword")).toBe(
+                "Choose a less common password.",
+            );
+            expect(validateAccountPassword("z".repeat(20))).toBe(
+                "Choose a less common password.",
+            );
+            expect(
+                validateAccountPassword(
+                    "long-account-name",
+                    "Long-Account-Name",
+                ),
+            ).toBe("Choose a less common password.");
+        });
+    });
+
     describe("createUser", () => {
         it("requires a password for new accounts", async () => {
             expect.assertions(3);
@@ -109,6 +140,98 @@ describe("Database", () => {
                 });
             });
         });
+
+        it("rolls back the user when initial device creation fails", async () => {
+            expect.assertions(5);
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const signKey = "c".repeat(64);
+                            const [first, firstError] =
+                                await provider.createUser(
+                                    new Uint8Array(16).fill(1),
+                                    {
+                                        ...devicePayload("desktop", signKey),
+                                        password:
+                                            "correct horse battery staple",
+                                    },
+                                );
+                            expect(firstError).toBeNull();
+                            expect(first).not.toBeNull();
+
+                            const [second, secondError] =
+                                await provider.createUser(
+                                    new Uint8Array(16).fill(2),
+                                    {
+                                        ...devicePayload("mobile", signKey),
+                                        password:
+                                            "correct horse battery staple",
+                                        username: "bob",
+                                    },
+                                );
+                            expect(secondError).toBeInstanceOf(Error);
+                            expect(second).toBeNull();
+                            await expect(
+                                provider.retrieveUser("bob"),
+                            ).resolves.toBeNull();
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            await provider.close().catch(() => undefined);
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
+    describe("createDevice", () => {
+        it("bounds active device clusters", async () => {
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            for (
+                                let index = 0;
+                                index < MAX_ACTIVE_DEVICES_PER_USER;
+                                index += 1
+                            ) {
+                                await provider.createDevice(
+                                    userID,
+                                    devicePayload(
+                                        `device-${String(index)}`,
+                                        index.toString(16).padStart(64, "0"),
+                                    ),
+                                );
+                            }
+
+                            await expect(
+                                provider.createDevice(
+                                    userID,
+                                    devicePayload(
+                                        "one-too-many",
+                                        "f".repeat(64),
+                                    ),
+                                ),
+                            ).rejects.toThrow("limited to 20 active devices");
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            await provider.close().catch(() => undefined);
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
     });
 
     describe("saveOTK", () => {

package/src/__tests__/connectAuth.spec.ts

@@ -11,14 +11,18 @@ import type { Server } from "node:http";
 import express from "express";
 
 import { xSignAsync, xSignKeyPair, XUtils } from "@vex-chat/crypto";
-import { TokenScopes } from "@vex-chat/types";
+import {
+    MAX_FILE_UPLOAD_BASE64_LENGTH,
+    MAX_FILE_UPLOAD_BYTES,
+    MAX_FILE_UPLOAD_ENCODED_BODY_BYTES,
+    TokenScopes,
+} from "@vex-chat/types";
 
-import jwt from "jsonwebtoken";
 import { parse as uuidParse } from "uuid";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { initApp } from "../server/index.ts";
-import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
 import { msgpack } from "../utils/msgpack.ts";
 
 const originalJwtSecret = process.env["JWT_SECRET"];
@@ -74,7 +78,7 @@ describe("device connect auth", () => {
                 Uint8Array.from(uuidParse(connectToken)),
                 signKeys.secretKey,
             );
-            const token = jwt.sign({ user }, getJwtSecret());
+            const token = signAuthJwt({ scope: "user", user }, "5m");
 
             const res = await fetch(
                 `http://127.0.0.1:${String(address.port)}/device/${device.deviceID}/connect`,
@@ -97,6 +101,144 @@ describe("device connect auth", () => {
             await close(server);
         }
     });
+
+    it("does not let a passkey-scoped token enter regular account routes", async () => {
+        process.env["JWT_SECRET"] = "test-jwt-secret";
+        const db = {
+            retrievePasskeyInternal: () => Promise.resolve(null),
+        } as unknown as Database;
+        const app = express();
+        initApp(
+            app,
+            db,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const token = signAuthJwt(
+                {
+                    passkey: { passkeyID: "passkey-a" },
+                    scope: "passkey",
+                    user,
+                },
+                "5m",
+            );
+
+            const res = await fetch(
+                `http://127.0.0.1:${String(address.port)}/server/server-a`,
+                { headers: { Authorization: `Bearer ${token}` } },
+            );
+
+            expect(res.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+
+    it("limits the default development CORS policy to local app origins", async () => {
+        const originalCorsOrigins = process.env["CORS_ORIGINS"];
+        delete process.env["CORS_ORIGINS"];
+        const app = express();
+        initApp(
+            app,
+            {} as Database,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const url = `http://127.0.0.1:${String(address.port)}/server/server-a`;
+            const preflightHeaders = {
+                "Access-Control-Request-Method": "GET",
+            };
+            const blocked = await fetch(url, {
+                headers: {
+                    ...preflightHeaders,
+                    Origin: "https://attacker.example",
+                },
+                method: "OPTIONS",
+            });
+            const allowed = await fetch(url, {
+                headers: {
+                    ...preflightHeaders,
+                    Origin: "http://localhost:5180",
+                },
+                method: "OPTIONS",
+            });
+
+            expect(
+                blocked.headers.get("access-control-allow-origin"),
+            ).toBeNull();
+            expect(allowed.headers.get("access-control-allow-origin")).toBe(
+                "http://localhost:5180",
+            );
+        } finally {
+            if (originalCorsOrigins === undefined) {
+                delete process.env["CORS_ORIGINS"];
+            } else {
+                process.env["CORS_ORIGINS"] = originalCorsOrigins;
+            }
+            await close(server);
+        }
+    });
+
+    it("accepts a fallback upload body above the default parser limit", async () => {
+        expect(MAX_FILE_UPLOAD_BASE64_LENGTH).toBe(
+            4 * Math.ceil(MAX_FILE_UPLOAD_BYTES / 3),
+        );
+        expect(MAX_FILE_UPLOAD_ENCODED_BODY_BYTES).toBeGreaterThan(
+            MAX_FILE_UPLOAD_BASE64_LENGTH,
+        );
+
+        const encodedFileLength = 20 * 1024 * 1024 + 1;
+        expect(encodedFileLength).toBeLessThan(MAX_FILE_UPLOAD_BASE64_LENGTH);
+        const app = express();
+        initApp(
+            app,
+            {} as Database,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const response = await fetch(
+                `http://127.0.0.1:${String(address.port)}/file/json`,
+                {
+                    body: msgpack.encode({
+                        file: "A".repeat(encodedFileLength),
+                        nonce: "a".repeat(48),
+                        owner: "device-a",
+                    }),
+                    headers: { "Content-Type": "application/msgpack" },
+                    method: "POST",
+                },
+            );
+
+            // Parsing succeeded; authentication is the next middleware.
+            expect(response.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    }, 15_000);
 });
 
 function close(server: Server): Promise<void> {

package/src/__tests__/deviceTokenRevalidation.spec.ts

@@ -4,13 +4,14 @@
  * Commercial licenses available at vex.wtf
  */
 
+import type { Database } from "../Database.ts";
 import type { Device, User } from "@vex-chat/types";
 import type express from "express";
 
-import jwt from "jsonwebtoken";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { createCheckDevice } from "../server/index.ts";
+import { createCheckDevice, createCheckPasskey } from "../server/index.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
 
 const jwtSecret = "test-jwt-secret";
 
@@ -29,6 +30,8 @@ const device: Device = {
     signKey: "sign-key-a",
 };
 
+const passkeyID = "passkey-a";
+
 function makeReq(token: string, reqUser: undefined | User = user) {
     return {
         headers: { "x-device-token": token },
@@ -37,7 +40,7 @@ function makeReq(token: string, reqUser: undefined | User = user) {
 }
 
 function makeToken(tokenDevice: Device = device): string {
-    return jwt.sign({ device: tokenDevice }, jwtSecret);
+    return signAuthJwt({ device: tokenDevice, scope: "device" }, "5m");
 }
 
 describe("createCheckDevice", () => {
@@ -102,3 +105,54 @@ describe("createCheckDevice", () => {
         expect(req.device).toBeUndefined();
     });
 });
+
+describe("createCheckPasskey", () => {
+    function makePasskeyReq(reqUser: User = user) {
+        return {
+            bearerToken: "passkey-token",
+            headers: {},
+            passkey: { passkeyID },
+            user: reqUser,
+        } as unknown as express.Request;
+    }
+
+    function makePasskeyDb(row: null | { userID: string }) {
+        return {
+            retrievePasskeyInternal: vi.fn(() => Promise.resolve(row)),
+        } as unknown as Pick<Database, "retrievePasskeyInternal">;
+    }
+
+    it("keeps a passkey session while its credential remains bound", async () => {
+        const db = makePasskeyDb({ userID: user.userID });
+        const req = makePasskeyReq();
+        const next = vi.fn();
+
+        await createCheckPasskey(db)(req, {} as express.Response, next);
+
+        expect(req.passkey).toEqual({ passkeyID });
+        expect(req.user).toEqual(user);
+        expect(db.retrievePasskeyInternal).toHaveBeenCalledWith(passkeyID);
+        expect(next).toHaveBeenCalledOnce();
+    });
+
+    it("revokes a passkey session as soon as its credential is removed", async () => {
+        const db = makePasskeyDb(null);
+        const req = makePasskeyReq();
+
+        await createCheckPasskey(db)(req, {} as express.Response, vi.fn());
+
+        expect(req.bearerToken).toBeUndefined();
+        expect(req.passkey).toBeUndefined();
+        expect(req.user).toBeUndefined();
+    });
+
+    it("rejects a passkey credential bound to a different account", async () => {
+        const db = makePasskeyDb({ userID: "user-b" });
+        const req = makePasskeyReq();
+
+        await createCheckPasskey(db)(req, {} as express.Response, vi.fn());
+
+        expect(req.passkey).toBeUndefined();
+        expect(req.user).toBeUndefined();
+    });
+});

package/src/__tests__/passkeyDevices.spec.ts

@@ -0,0 +1,94 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { describe, expect, it, vi } from "vitest";
+
+import { getPasskeyDeviceRouter } from "../server/passkeyDevices.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+const device: Device = {
+    deleted: false,
+    deviceID: "device-a",
+    lastLogin: new Date(0).toISOString(),
+    name: "desktop",
+    owner: user.userID,
+    signKey: "a".repeat(64),
+};
+
+describe("passkey device administration", () => {
+    it("disconnects a device immediately after deleting it", async () => {
+        const deleteDevice = vi.fn(() => Promise.resolve());
+        const db = {
+            deleteDevice,
+            retrieveDevice: vi.fn((deviceID: string) =>
+                Promise.resolve(deviceID === device.deviceID ? device : null),
+            ),
+        } as unknown as Database;
+        const disconnectDevices = vi.fn();
+        const notify = vi.fn();
+        const app = express();
+        app.use((req, _res, next) => {
+            req.passkey = { passkeyID: "passkey-a" };
+            req.user = user;
+            next();
+        });
+        app.use(getPasskeyDeviceRouter(db, notify, disconnectDevices));
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const response = await fetch(
+                `http://127.0.0.1:${String(address.port)}/user/${user.userID}/passkey/devices/${device.deviceID}`,
+                { method: "DELETE" },
+            );
+
+            expect(response.status).toBe(200);
+            expect(deleteDevice).toHaveBeenCalledWith(device.deviceID);
+            expect(disconnectDevices).toHaveBeenCalledWith([device.deviceID]);
+            expect(notify).toHaveBeenCalledWith(
+                user.userID,
+                "deviceListChanged",
+                expect.any(String),
+            );
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}

package/src/__tests__/passkeys.spec.ts

@@ -9,7 +9,6 @@ import type { SpireOptions } from "../Spire.ts";
 import { describe, expect, it, vi } from "vitest";
 
 import { Database } from "../Database.ts";
-import { passkeySecondFactorError } from "../Spire.ts";
 
 vi.mock("uuid", () => ({
     parse: (s: string) => {
@@ -181,7 +180,7 @@ describe("Database passkeys", () => {
 
     describe("markPasskeyUsed", () => {
         it("bumps the signature counter and lastUsedAt timestamp", async () => {
-            expect.assertions(3);
+            expect.assertions(5);
             await withDb(async (db) => {
                 const created = await db.createPasskey(
                     userID,
@@ -192,63 +191,25 @@ describe("Database passkeys", () => {
                     samplePasskey.transports,
                 );
 
-                await db.markPasskeyUsed(created.passkeyID, 42);
+                await expect(
+                    db.markPasskeyUsed(created.passkeyID, 0, 42),
+                ).resolves.toBe(true);
                 const row = await db.retrievePasskeyInternal(created.passkeyID);
 
                 expect(row).not.toBeNull();
                 if (row === null) return;
                 expect(row.signCount).toBe(42);
                 expect(row.lastUsedAt).not.toBeNull();
+                await expect(
+                    db.markPasskeyUsed(created.passkeyID, 0, 43),
+                ).resolves.toBe(false);
             });
         });
     });
 
-    describe("passkeySecondFactorError", () => {
-        it("allows bootstrap login when the account has no passkeys", async () => {
+    describe("device passkey approval records", () => {
+        it("records passkey-backed device approval metadata", async () => {
             expect.assertions(1);
-            await withDb(async (db) => {
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBeNull();
-            });
-        });
-
-        it("requires a matching passkey once the account has one", async () => {
-            expect.assertions(3);
-            await withDb(async (db) => {
-                const created = await db.createPasskey(
-                    userID,
-                    samplePasskey.name,
-                    samplePasskey.credentialID,
-                    samplePasskey.publicKeyHex,
-                    samplePasskey.algorithm,
-                    samplePasskey.transports,
-                );
-
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
-                await expect(
-                    passkeySecondFactorError(
-                        db,
-                        userID,
-                        "not-this-passkey",
-                        "mismatch",
-                    ),
-                ).resolves.toBe("mismatch");
-                await expect(
-                    passkeySecondFactorError(
-                        db,
-                        userID,
-                        created.passkeyID,
-                        "mismatch",
-                    ),
-                ).resolves.toBeNull();
-            });
-        });
-
-        it("does not treat device approval as future passkey verification", async () => {
-            expect.assertions(3);
             await withDb(async (db) => {
                 const created = await db.createPasskey(
                     userID,
@@ -264,15 +225,9 @@ describe("Database passkeys", () => {
                     { approvedByPasskeyID: created.passkeyID },
                 );
 
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
                 await expect(
                     db.isDevicePasskeyApproved(userID, device.deviceID),
                 ).resolves.toBe(true);
-                await expect(
-                    passkeySecondFactorError(db, userID, undefined, "mismatch"),
-                ).resolves.toBe("Passkey verification required.");
             });
         });