@vex-chat/spire 3.0.0 → 4.0.0

package/src/utils/loadEnv.ts

@@ -10,6 +10,7 @@ const REQUIRED_ENV_VARS = ["DB_TYPE", "JWT_SECRET", "SPK"] as const;
 const NORMALIZED_ENV_VARS = [
     ...REQUIRED_ENV_VARS,
     "API_PORT",
+    "SPIRE_TRUST_PROXY_HOPS",
     "SPIRE_FIPS",
     "SPIRE_PASSKEY_RP_ID",
     "SPIRE_PASSKEY_RP_NAME",
@@ -82,6 +83,9 @@ export function validateSpireRuntimeEnv(
             "JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.",
         );
     }
+    if (jwtSecret.length < 32) {
+        throw new Error("JWT_SECRET must contain at least 32 characters.");
+    }
     if (jwtSecret === spk) {
         throw new Error("JWT_SECRET must be separate from SPK.");
     }

package/src/utils/preKeySignature.ts

@@ -6,13 +6,7 @@
 
 import type { DevicePayload, PreKeysWS } from "@vex-chat/types";
 
-import {
-    getCryptoProfile,
-    xConcat,
-    xConstants,
-    xEncode,
-    XUtils,
-} from "@vex-chat/crypto";
+import { xPreKeySignaturePayload, XUtils } from "@vex-chat/crypto";
 
 import { spireXSignOpenAsync } from "./spireXSignOpenAsync.ts";
 
@@ -24,6 +18,7 @@ export async function verifyDevicePayloadPreKeySignature(
             XUtils.decodeHex(payload.preKey),
             XUtils.decodeHex(payload.preKeySignature),
             payload.signKey,
+            "signed",
         );
     } catch {
         return false;
@@ -33,20 +28,21 @@ export async function verifyDevicePayloadPreKeySignature(
 export async function verifyPreKeyWsSignature(
     preKey: PreKeysWS,
     signKeyHex: string,
+    kind: "one-time" | "signed",
 ): Promise<boolean> {
-    return verifySignedPreKey(preKey.publicKey, preKey.signature, signKeyHex);
-}
-
-function preKeySignPayload(publicKey: Uint8Array): Uint8Array {
-    return getCryptoProfile() === "fips"
-        ? xConcat(new Uint8Array([0xa1]), publicKey)
-        : xEncode(xConstants.CURVE, publicKey);
+    return verifySignedPreKey(
+        preKey.publicKey,
+        preKey.signature,
+        signKeyHex,
+        kind,
+    );
 }
 
 async function verifySignedPreKey(
     publicKey: Uint8Array,
     signature: Uint8Array,
     signKeyHex: string,
+    kind: "one-time" | "signed",
 ): Promise<boolean> {
     try {
         const opened = await spireXSignOpenAsync(
@@ -54,7 +50,8 @@ async function verifySignedPreKey(
             XUtils.decodeHex(signKeyHex),
         );
         return Boolean(
-            opened && XUtils.bytesEqual(opened, preKeySignPayload(publicKey)),
+            opened &&
+            XUtils.bytesEqual(opened, xPreKeySignaturePayload(publicKey, kind)),
         );
     } catch {
         return false;

package/dist/migrations/2026-04-14_argon2id-password-hashing.js

@@ -1,17 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-import { sql } from "kysely";
-export async function down(db) {
-    await db.schema.alterTable("users").dropColumn("hashAlgo").execute();
-}
-export async function up(db) {
-    await db.schema
-        .alterTable("users")
-        .addColumn("hashAlgo", "varchar(16)", (cb) => cb.defaultTo("pbkdf2").notNull())
-        .execute();
-    await sql `UPDATE users SET hashAlgo = 'pbkdf2' WHERE hashAlgo = 'pbkdf2'`.execute(db);
-}
-//# sourceMappingURL=2026-04-14_argon2id-password-hashing.js.map

package/dist/migrations/2026-04-14_argon2id-password-hashing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"2026-04-14_argon2id-password-hashing.js","sourceRoot":"","sources":["../../src/migrations/2026-04-14_argon2id-password-hashing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAe,GAAG,EAAE,MAAM,QAAQ,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB;IACxC,MAAM,EAAE,CAAC,MAAM;SACV,UAAU,CAAC,OAAO,CAAC;SACnB,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CACzC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CACnC;SACA,OAAO,EAAE,CAAC;IAEf,MAAM,GAAG,CAAA,gEAAgE,CAAC,OAAO,CAC7E,EAAE,CACL,CAAC;AACN,CAAC"}

package/dist/server/passkeySecondFactor.js

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-export async function passkeySecondFactorError(db, userID, passkeyID, mismatchError) {
-    const passkeys = await db.retrievePasskeysByUser(userID);
-    if (passkeys.length === 0) {
-        return null;
-    }
-    if (!passkeyID) {
-        return "Passkey verification required.";
-    }
-    const passkey = await db.retrievePasskeyInternal(passkeyID);
-    if (!passkey || passkey.userID !== userID) {
-        return mismatchError;
-    }
-    return null;
-}
-//# sourceMappingURL=passkeySecondFactor.js.map

package/dist/server/passkeySecondFactor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeySecondFactor.js","sourceRoot":"","sources":["../../src/server/passkeySecondFactor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,EAAY,EACZ,MAAc,EACd,SAA6B,EAC7B,aAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,gCAAgC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/src/migrations/2026-04-14_argon2id-password-hashing.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-
-import { type Kysely, sql } from "kysely";
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-    await db.schema.alterTable("users").dropColumn("hashAlgo").execute();
-}
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-    await db.schema
-        .alterTable("users")
-        .addColumn("hashAlgo", "varchar(16)", (cb) =>
-            cb.defaultTo("pbkdf2").notNull(),
-        )
-        .execute();
-
-    await sql`UPDATE users SET hashAlgo = 'pbkdf2' WHERE hashAlgo = 'pbkdf2'`.execute(
-        db,
-    );
-}

package/src/server/passkeySecondFactor.ts

@@ -1,27 +0,0 @@
-/**
- * Copyright (c) 2020-2026 Vex Heavy Industries LLC
- * Licensed under AGPL-3.0. See LICENSE for details.
- * Commercial licenses available at vex.wtf
- */
-
-import type { Database } from "../Database.ts";
-
-export async function passkeySecondFactorError(
-    db: Database,
-    userID: string,
-    passkeyID: string | undefined,
-    mismatchError: string,
-): Promise<null | string> {
-    const passkeys = await db.retrievePasskeysByUser(userID);
-    if (passkeys.length === 0) {
-        return null;
-    }
-    if (!passkeyID) {
-        return "Passkey verification required.";
-    }
-    const passkey = await db.retrievePasskeyInternal(passkeyID);
-    if (!passkey || passkey.userID !== userID) {
-        return mismatchError;
-    }
-    return null;
-}