@vex-chat/spire 3.0.0 → 4.0.0

package/src/__tests__/password.spec.ts

@@ -0,0 +1,223 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import {
+    afterAll,
+    afterEach,
+    beforeAll,
+    describe,
+    expect,
+    it,
+    vi,
+} from "vitest";
+
+import { hashPasswordArgon2, verifyPassword } from "../Database.ts";
+import { errorHandler } from "../server/errors.ts";
+import { getPasswordRouter } from "../server/password.ts";
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const otherUserID = "93ce482b-a0f2-4f6e-b1df-3aed61073552";
+const passkeyID = "passkey-1";
+const initialPassword = "This is the original password";
+const replacementPassword = "This is the replacement password";
+const servers: Array<{ close: () => void }> = [];
+const originalDisableRateLimits = process.env["SPIRE_DISABLE_RATE_LIMITS"];
+let initialPasswordHash = "";
+
+beforeAll(async () => {
+    process.env["SPIRE_DISABLE_RATE_LIMITS"] = "true";
+    initialPasswordHash = await hashPasswordArgon2(initialPassword);
+});
+
+afterEach(() => {
+    for (const server of servers.splice(0)) server.close();
+});
+
+afterAll(() => {
+    if (originalDisableRateLimits === undefined) {
+        delete process.env["SPIRE_DISABLE_RATE_LIMITS"];
+    } else {
+        process.env["SPIRE_DISABLE_RATE_LIMITS"] = originalDisableRateLimits;
+    }
+});
+
+describe("verifyPassword", () => {
+    it.each(["not-an-argon2-hash", "pbkdf2$100000$salt$hash"])(
+        "fails closed for an unsupported stored hash: %s",
+        async (passwordHash) => {
+            await expect(
+                verifyPassword(initialPassword, { passwordHash }),
+            ).resolves.toEqual({ needsRehash: false, valid: false });
+        },
+    );
+});
+
+describe("PATCH /user/:id/password", () => {
+    it("changes a password after approved-device and current-password proof", async () => {
+        const harness = await mountPasswordRouter("device");
+        const response = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(204);
+        expect(harness.rehashPassword).toHaveBeenCalledOnce();
+        await expectPassword(harness.passwordHash(), replacementPassword, true);
+        await expectPassword(harness.passwordHash(), initialPassword, false);
+    });
+
+    it("rejects missing or incorrect current-password proof", async () => {
+        const harness = await mountPasswordRouter("device");
+        const missing = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+        const incorrect = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: "This is definitely not the password",
+            newPassword: replacementPassword,
+        });
+
+        expect(missing.status).toBe(401);
+        expect(incorrect.status).toBe(401);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+
+    it("resets a password after fresh passkey proof", async () => {
+        const harness = await mountPasswordRouter("passkey");
+        const response = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(204);
+        await expectPassword(harness.passwordHash(), replacementPassword, true);
+    });
+
+    it("rejects passkeys that are no longer bound to the account", async () => {
+        const harness = await mountPasswordRouter("passkey", false);
+        const response = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(401);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+
+    it("rejects cross-account targeting, reuse, and common passwords", async () => {
+        const harness = await mountPasswordRouter("device");
+        const crossAccount = await patchPassword(harness.baseUrl, otherUserID, {
+            currentPassword: initialPassword,
+            newPassword: replacementPassword,
+        });
+        const reused = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: initialPassword,
+        });
+        const common = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: "passwordpassword",
+        });
+
+        expect(crossAccount.status).toBe(403);
+        expect(reused.status).toBe(409);
+        expect(common.status).toBe(400);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+});
+
+async function expectPassword(
+    passwordHash: string,
+    password: string,
+    expected: boolean,
+): Promise<void> {
+    const result = await verifyPassword(password, { passwordHash });
+    expect(result.valid).toBe(expected);
+}
+
+async function mountPasswordRouter(
+    auth: "device" | "passkey",
+    passkeyExists = true,
+): Promise<{
+    baseUrl: string;
+    passwordHash: () => string;
+    rehashPassword: ReturnType<typeof vi.fn>;
+}> {
+    let passwordHash = initialPasswordHash;
+    const rehashPassword = vi.fn((_userID: string, nextHash: string) => {
+        passwordHash = nextHash;
+        return Promise.resolve();
+    });
+    const db = {
+        rehashPassword,
+        retrievePasskeyInternal: vi.fn(() =>
+            Promise.resolve(passkeyExists ? { passkeyID, userID } : null),
+        ),
+        retrieveUser: vi.fn((identifier: string) =>
+            Promise.resolve(
+                identifier === userID
+                    ? {
+                          lastSeen: new Date().toISOString(),
+                          passwordHash,
+                          userID,
+                          username: "alice",
+                      }
+                    : null,
+            ),
+        ),
+    } as unknown as Database;
+
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        req.user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        if (auth === "device") {
+            req.device = {
+                deleted: false,
+                deviceID: "device-1",
+                lastLogin: new Date().toISOString(),
+                name: "Test device",
+                owner: userID,
+                signKey: "a".repeat(64),
+            };
+        } else {
+            req.passkey = { passkeyID };
+        }
+        next();
+    });
+    app.use(getPasswordRouter(db));
+    app.use(errorHandler());
+
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            const { port } = server.address() as AddressInfo;
+            resolve({
+                baseUrl: `http://127.0.0.1:${String(port)}`,
+                passwordHash: () => passwordHash,
+                rehashPassword,
+            });
+        });
+        servers.push(server);
+    });
+}
+
+async function patchPassword(
+    baseUrl: string,
+    routeUserID: string,
+    body: { currentPassword?: string; newPassword: string },
+): Promise<Response> {
+    return fetch(`${baseUrl}/user/${routeUserID}/password`, {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        method: "PATCH",
+    });
+}

package/src/__tests__/permissions.spec.ts

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Permission } from "@vex-chat/types";
+
+import { describe, expect, it } from "vitest";
+
+import {
+    canDeletePermission,
+    hasPermission,
+    userHasPermission,
+} from "../server/permissions.ts";
+
+function permission(
+    userID: string,
+    powerLevel: number,
+    permissionID = `${userID}-${String(powerLevel)}`,
+): Permission {
+    return {
+        permissionID,
+        powerLevel,
+        resourceID: "server-a",
+        resourceType: "server",
+        userID,
+    };
+}
+
+describe("server permissions", () => {
+    it("treats a minimum power level as inclusive", () => {
+        const permissions = [permission("alice", 50)];
+        expect(hasPermission(permissions, "server-a", 50)).toBe(true);
+        expect(userHasPermission(permissions, "alice", 50)).toBe(true);
+    });
+
+    it("does not let an ordinary member remove another user's permission", () => {
+        const actor = permission("alice", 0);
+        const target = permission("bob", 0);
+        expect(canDeletePermission([actor], "alice", target, 50)).toBe(false);
+    });
+
+    it("allows self-removal and higher-power moderation", () => {
+        const own = permission("alice", 0);
+        const admin = permission("admin", 100);
+        expect(canDeletePermission([own], "alice", own, 50)).toBe(true);
+        expect(canDeletePermission([admin], "admin", own, 50)).toBe(true);
+    });
+});

package/src/__tests__/preKeySignature.spec.ts

@@ -7,8 +7,7 @@
 import {
     setCryptoProfile,
     xBoxKeyPairAsync,
-    xConstants,
-    xEncode,
+    xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPair,
     XUtils,
@@ -25,7 +24,7 @@ async function makeSignedPreKey() {
     const signKeys = xSignKeyPair();
     const preKey = await xBoxKeyPairAsync();
     const signature = await xSignAsync(
-        xEncode(xConstants.CURVE, preKey.publicKey),
+        xPreKeySignaturePayload(preKey.publicKey, "signed"),
         signKeys.secretKey,
     );
     return { preKey, signature, signKeys };
@@ -55,6 +54,7 @@ describe("prekey signature validation", () => {
                     signature,
                 },
                 XUtils.encodeHex(signKeys.publicKey),
+                "signed",
             ),
         ).resolves.toBe(true);
     });
@@ -71,4 +71,21 @@ describe("prekey signature validation", () => {
             }),
         ).resolves.toBe(false);
     });
+
+    it("does not accept a signed prekey as a one-time prekey", async () => {
+        const { preKey, signature, signKeys } = await makeSignedPreKey();
+
+        await expect(
+            verifyPreKeyWsSignature(
+                {
+                    deviceID: "device-a",
+                    index: 1,
+                    publicKey: preKey.publicKey,
+                    signature,
+                },
+                XUtils.encodeHex(signKeys.publicKey),
+                "one-time",
+            ),
+        ).resolves.toBe(false);
+    });
 });

package/src/db/schema.ts

@@ -276,10 +276,8 @@ export type ServiceMetricUpdate = Updateable<ServiceMetricsTable>;
 
 export type UserRow = Selectable<UsersTable>;
 export interface UsersTable {
-    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
-    passwordSalt: string;
     userID: string;
     username: string;
 }

package/src/migrations/2026-04-06_initial-schema.ts

@@ -31,11 +31,10 @@ export async function up(db: Kysely<unknown>): Promise<void> {
     await db.schema
         .createTable("users")
         .ifNotExists()
-        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey())
-        .addColumn("username", "varchar(255)", (cb) => cb.unique())
-        .addColumn("passwordHash", "text")
-        .addColumn("passwordSalt", "text")
-        .addColumn("lastSeen", "text")
+        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey().notNull())
+        .addColumn("username", "varchar(255)", (cb) => cb.unique().notNull())
+        .addColumn("passwordHash", "text", (cb) => cb.notNull())
+        .addColumn("lastSeen", "text", (cb) => cb.notNull())
         .execute();
 
     await db.schema

package/src/migrations/2026-07-14_query-indexes.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropIndex("channels_serverID_idx").ifExists().execute();
+    await db.schema.dropIndex("devices_owner_deleted_idx").ifExists().execute();
+    await db.schema.dropIndex("permissions_user_type_idx").ifExists().execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createIndex("devices_owner_deleted_idx")
+        .ifNotExists()
+        .on("devices")
+        .columns(["owner", "deleted"])
+        .execute();
+    await db.schema
+        .createIndex("channels_serverID_idx")
+        .ifNotExists()
+        .on("channels")
+        .column("serverID")
+        .execute();
+    await db.schema
+        .createIndex("permissions_user_type_idx")
+        .ifNotExists()
+        .on("permissions")
+        .columns(["userID", "resourceType"])
+        .execute();
+}

package/src/server/avatar.ts

@@ -21,13 +21,20 @@ import { getParam, getUser } from "./utils.ts";
 import { ALLOWED_IMAGE_TYPES, protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+const MAX_AVATAR_BYTES = 5 * 1024 * 1024;
+const avatarUpload = multer({
+    limits: { fields: 1, files: 1, fileSize: MAX_AVATAR_BYTES, parts: 2 },
+});
 
 // Avatars are public, unencrypted images. The body for the JSON path is just a
 // base64-encoded image; nothing else. Do NOT reuse FilePayloadSchema here —
 // that schema is for encrypted user-file uploads and requires nonce/owner/signed,
 // which the avatar client never sends (and shouldn't).
 const avatarJsonPayload = z.object({
-    file: z.string().min(1),
+    file: z
+        .string()
+        .min(1)
+        .max(Math.ceil((MAX_AVATAR_BYTES * 4) / 3) + 4),
 });
 
 export const getAvatarRouter = () => {
@@ -56,7 +63,7 @@ export const getAvatarRouter = () => {
         stream.pipe(res);
     });
 
-    router.post("/:userID/json", protect, async (req, res) => {
+    router.post("/:userID/json", uploadLimiter, protect, async (req, res) => {
         const parsed = avatarJsonPayload.safeParse(req.body);
         if (!parsed.success) {
             res.status(400).json({
@@ -73,8 +80,22 @@ export const getAvatarRouter = () => {
             res.sendStatus(401);
             return;
         }
+        if (getParam(req, "userID") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
 
-        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        let buf: Buffer;
+        try {
+            buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        } catch {
+            res.status(400).send({ error: "Avatar must be valid base64." });
+            return;
+        }
+        if (buf.byteLength > MAX_AVATAR_BYTES) {
+            res.sendStatus(413);
+            return;
+        }
         const mimeType = await fileTypeFromBuffer(buf);
         if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
             res.status(400).send({
@@ -99,7 +120,7 @@ export const getAvatarRouter = () => {
         "/:userID",
         uploadLimiter,
         protect,
-        multer().single("avatar"),
+        avatarUpload.single("avatar"),
         async (req, res) => {
             const userDetails = getUser(req);
             const deviceDetails = req.device;
@@ -108,6 +129,10 @@ export const getAvatarRouter = () => {
                 res.sendStatus(401);
                 return;
             }
+            if (getParam(req, "userID") !== userDetails.userID) {
+                res.sendStatus(403);
+                return;
+            }
 
             if (!req.file) {
                 res.sendStatus(400);

package/src/server/errors.ts

@@ -35,6 +35,7 @@ import type { ErrorRequestHandler } from "express";
 
 import { randomUUID } from "node:crypto";
 
+import multer from "multer";
 import { ZodError } from "zod/v4";
 
 /**
@@ -92,6 +93,12 @@ export const errorHandler =
             status = 400;
             clientMessage = "Validation failed";
             details = err.issues;
+        } else if (err instanceof multer.MulterError) {
+            status = err.code === "LIMIT_FILE_SIZE" ? 413 : 400;
+            clientMessage =
+                err.code === "LIMIT_FILE_SIZE"
+                    ? "Uploaded file is too large"
+                    : "Invalid multipart upload";
         } else if (err instanceof AppError) {
             status = err.status;
             clientMessage = err.message;

package/src/server/file.ts

@@ -14,7 +14,7 @@ import * as path from "node:path";
 import express from "express";
 
 import { XUtils } from "@vex-chat/crypto";
-import { FilePayloadSchema } from "@vex-chat/types";
+import { FilePayloadSchema, MAX_FILE_UPLOAD_BYTES } from "@vex-chat/types";
 
 import multer from "multer";
 import { z } from "zod/v4";
@@ -27,6 +27,14 @@ import { getParam } from "./utils.ts";
 import { protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+const fileUpload = multer({
+    limits: {
+        fields: 4,
+        files: 1,
+        fileSize: MAX_FILE_UPLOAD_BYTES,
+        parts: 5,
+    },
+});
 
 export const getFileRouter = (db: Database) => {
     const router = express.Router();
@@ -77,7 +85,7 @@ export const getFileRouter = (db: Database) => {
         }
     });
 
-    router.post("/json", protect, async (req, res) => {
+    router.post("/json", uploadLimiter, protect, async (req, res) => {
         const deviceDetails = req.device;
 
         if (!deviceDetails) {
@@ -95,17 +103,28 @@ export const getFileRouter = (db: Database) => {
         }
         const payload = parsed.data;
 
-        if (payload.nonce === "") {
+        if (!payload.file) {
             res.sendStatus(400);
             return;
         }
-
-        if (!payload.file) {
-            res.sendStatus(400);
+        if (payload.owner !== deviceDetails.deviceID) {
+            res.status(400).send({
+                error: "File owner must match this device.",
+            });
             return;
         }
 
-        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        let buf: Buffer;
+        try {
+            buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        } catch {
+            res.status(400).send({ error: "File must be valid base64." });
+            return;
+        }
+        if (buf.byteLength > MAX_FILE_UPLOAD_BYTES) {
+            res.sendStatus(413);
+            return;
+        }
 
         const newFile: FileSQL = {
             fileID: crypto.randomUUID(),
@@ -120,20 +139,20 @@ export const getFileRouter = (db: Database) => {
 
     // Multipart file upload — form fields are strings from multer, not full FilePayload
     const multipartFields = z.object({
-        nonce: z.string().min(1),
-        owner: z.string().min(1),
+        nonce: z.string().regex(/^[0-9a-fA-F]{48}$/),
+        owner: z.string().min(1).max(128),
     });
 
     router.post(
         "/",
         uploadLimiter,
         protect,
-        multer().single("file"),
+        fileUpload.single("file"),
         async (req, res) => {
             const deviceDetails = req.device;
 
             if (!deviceDetails) {
-                res.sendStatus(400);
+                res.sendStatus(401);
                 return;
             }
 
@@ -152,8 +171,10 @@ export const getFileRouter = (db: Database) => {
                 return;
             }
 
-            if (payload.nonce === "") {
-                res.sendStatus(400);
+            if (payload.owner !== deviceDetails.deviceID) {
+                res.status(400).send({
+                    error: "File owner must match this device.",
+                });
                 return;
             }