@vex-chat/spire 3.0.1 → 4.0.0

package/src/server/passkey.ts

@@ -28,10 +28,9 @@ import {
     verifyAuthenticationResponse,
     verifyRegistrationResponse,
 } from "@simplewebauthn/server";
-import jwt from "jsonwebtoken";
 
 import { JWT_EXPIRY_PASSKEY } from "../Spire.ts";
-import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
 
 import { AppError } from "./errors.ts";
 import { authLimiter } from "./rateLimit.ts";
@@ -39,7 +38,7 @@ import { censorUser, getParam, getUser } from "./utils.ts";
 import { buildAndroidApkKeyHashOrigins } from "./wellKnown.ts";
 import { sendWireResponse } from "./wireResponse.ts";
 
-import { protect } from "./index.ts";
+import { protect, protectAnyAuth } from "./index.ts";
 
 const REGISTRATION_TTL_MS = 5 * 60 * 1000; // 5 min
 const AUTHENTICATION_TTL_MS = 5 * 60 * 1000;
@@ -56,6 +55,7 @@ interface PendingAuthentication {
 interface PendingRegistration {
     challenge: string;
     createdAt: number;
+    deviceID: string;
     name: string;
     userID: string;
 }
@@ -157,7 +157,7 @@ function sanitizeTransports(input: string[]): AuthenticatorTransportFuture[] {
  * Issues a passkey-scoped JWT.
  *
  * Carries `scope: "passkey"` and the owning userID; deliberately
- * shorter-lived than a device JWT (5 min vs 7 days) because a
+ * shorter-lived than an account or device JWT (5 min vs 1 hour) because a
  * passkey JWT grants destructive admin powers (delete a device,
  * approve an enrollment) without further user verification. Callers
  * re-do the WebAuthn ceremony when this expires.
@@ -166,14 +166,13 @@ function signPasskeyToken(args: {
     passkeyID: string;
     user: ReturnType<typeof censorUser>;
 }): string {
-    return jwt.sign(
+    return signAuthJwt(
         {
             passkey: { passkeyID: args.passkeyID },
             scope: "passkey" as const,
             user: args.user,
         },
-        getJwtSecret(),
-        { expiresIn: JWT_EXPIRY_PASSKEY },
+        JWT_EXPIRY_PASSKEY,
     );
 }
 
@@ -203,16 +202,13 @@ export const getPasskeyRouter = (db: Database) => {
                 return;
             }
 
-            const existing = await db.retrievePasskeysByUser(userID);
-            // A freshly registered account may add its first passkey with
-            // the account bearer before finishing device connect. Every later
-            // passkey addition must come from an authenticated device session.
-            if (!req.device && existing.length > 0) {
+            if (!req.device || req.device.owner !== userID) {
                 res.status(401).send({
-                    error: "Adding another passkey requires an authenticated device.",
+                    error: "Adding a passkey requires an authenticated device.",
                 });
                 return;
             }
+            const existing = await db.retrievePasskeysByUser(userID);
             if (existing.length >= MAX_PASSKEYS_PER_USER) {
                 res.status(409).send({
                     error: `Each account is limited to ${MAX_PASSKEYS_PER_USER} passkeys.`,
@@ -232,7 +228,7 @@ export const getPasskeyRouter = (db: Database) => {
                 authenticatorSelection: {
                     requireResidentKey: false,
                     residentKey: "preferred",
-                    userVerification: "preferred",
+                    userVerification: "required",
                 },
                 excludeCredentials: [],
                 rpID,
@@ -247,6 +243,7 @@ export const getPasskeyRouter = (db: Database) => {
             pendingRegistrations.set(requestID, {
                 challenge: options.challenge,
                 createdAt: Date.now(),
+                deviceID: req.device.deviceID,
                 name: parsed.data.name,
                 userID,
             });
@@ -285,17 +282,20 @@ export const getPasskeyRouter = (db: Database) => {
                 return;
             }
 
-            const existing = await db.retrievePasskeysByUser(userID);
-            if (!req.device && existing.length > 0) {
+            if (!req.device || req.device.owner !== userID) {
                 res.status(401).send({
-                    error: "Adding another passkey requires an authenticated device.",
+                    error: "Adding a passkey requires an authenticated device.",
                 });
                 return;
             }
 
             pruneRegistrations();
             const pending = pendingRegistrations.get(parsed.data.requestID);
-            if (!pending || pending.userID !== userID) {
+            if (
+                !pending ||
+                pending.userID !== userID ||
+                pending.deviceID !== req.device.deviceID
+            ) {
                 res.status(404).send({
                     error: "Registration request not found or expired.",
                 });
@@ -319,15 +319,14 @@ export const getPasskeyRouter = (db: Database) => {
                     expectedChallenge: pending.challenge,
                     expectedOrigin,
                     expectedRPID: rpID,
-                    requireUserVerification: false,
+                    requireUserVerification: true,
                     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
                     response: rawResponse as RegistrationResponseJSON,
                 });
             } catch (err: unknown) {
-                const message =
-                    err instanceof Error ? err.message : String(err);
+                logWebAuthnFailure("registration", err);
                 res.status(400).send({
-                    error: "Passkey attestation invalid: " + message,
+                    error: "Passkey attestation could not be verified.",
                 });
                 return;
             }
@@ -380,7 +379,7 @@ export const getPasskeyRouter = (db: Database) => {
         },
     );
 
-    router.get("/user/:id/passkeys", protect, async (req, res) => {
+    router.get("/user/:id/passkeys", protectAnyAuth, async (req, res) => {
         const userDetails = getUser(req);
         const userID = getParam(req, "id");
         if (userDetails.userID !== userID) {
@@ -402,6 +401,12 @@ export const getPasskeyRouter = (db: Database) => {
                 res.sendStatus(401);
                 return;
             }
+            if (!req.device || req.device.owner !== userID) {
+                res.status(401).send({
+                    error: "Removing a passkey requires an authenticated device.",
+                });
+                return;
+            }
             const row = await db.retrievePasskeyInternal(passkeyID);
             if (!row || row.userID !== userID) {
                 res.sendStatus(404);
@@ -456,7 +461,7 @@ export const getPasskeyRouter = (db: Database) => {
         const options = await generateAuthenticationOptions({
             allowCredentials: allowCredentials.filter((c) => c.id.length > 0),
             rpID,
-            userVerification: "preferred",
+            userVerification: "required",
         });
 
         pruneAuthentications();
@@ -541,13 +546,13 @@ export const getPasskeyRouter = (db: Database) => {
                 expectedChallenge: pending.challenge,
                 expectedOrigin,
                 expectedRPID: rpID,
-                requireUserVerification: false,
+                requireUserVerification: true,
                 response: assertion,
             });
         } catch (err: unknown) {
-            const message = err instanceof Error ? err.message : String(err);
+            logWebAuthnFailure("authentication", err);
             res.status(401).send({
-                error: "Passkey assertion invalid: " + message,
+                error: "Passkey assertion could not be verified.",
             });
             return;
         }
@@ -572,7 +577,17 @@ export const getPasskeyRouter = (db: Database) => {
             return;
         }
 
-        await db.markPasskeyUsed(passkeyRow.passkeyID, newCounter);
+        const counterUpdated = await db.markPasskeyUsed(
+            passkeyRow.passkeyID,
+            passkeyRow.signCount,
+            newCounter,
+        );
+        if (!counterUpdated) {
+            res.status(401).send({
+                error: "Passkey assertion was already used.",
+            });
+            return;
+        }
 
         const user = await db.retrieveUser(pending.userID);
         if (!user) {
@@ -593,3 +608,11 @@ export const getPasskeyRouter = (db: Database) => {
 
     return router;
 };
+
+function logWebAuthnFailure(ceremony: string, err: unknown): void {
+    const requestId = crypto.randomUUID();
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(
+        `[spire] WebAuthn ${ceremony} verification failed requestId=${requestId} message=${message}`,
+    );
+}

package/src/server/passkeyDevices.ts

@@ -86,6 +86,7 @@ export const getPasskeyDeviceRouter = (
             // "I lost my phone, sign in with the passkey, wipe the
             // old device, then recover onto a new one."
             await db.deleteDevice(deviceID);
+            disconnectDevices?.([deviceID]);
             // Tell whoever's online that the device-list shape
             // changed; clients use this to refresh the Settings →
             // Devices view in real time.

package/src/server/password.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+
+import express from "express";
+
+import { PasswordUpdatePayloadSchema } from "@vex-chat/types";
+
+import {
+    hashPasswordArgon2,
+    validateAccountPassword,
+    verifyPassword,
+} from "../Database.ts";
+
+import { AppError } from "./errors.ts";
+import { passwordUpdateLimiter } from "./rateLimit.ts";
+import { getParam, getUser } from "./utils.ts";
+
+import { protectAnyAuth } from "./index.ts";
+
+export const getPasswordRouter = (db: Database) => {
+    const router = express.Router();
+
+    router.patch(
+        "/user/:id/password",
+        protectAnyAuth,
+        passwordUpdateLimiter,
+        async (req, res) => {
+            const authenticatedUser = getUser(req);
+            const userID = getParam(req, "id");
+            if (authenticatedUser.userID !== userID) {
+                throw new AppError(403, "Not authorized for this account");
+            }
+
+            const payload = PasswordUpdatePayloadSchema.parse(req.body);
+            const user = await db.retrieveUser(userID);
+            if (!user) {
+                throw new AppError(404, "Account not found");
+            }
+
+            const passwordError = validateAccountPassword(
+                payload.newPassword,
+                user.username,
+            );
+            if (passwordError) {
+                throw new AppError(400, passwordError);
+            }
+
+            if (req.passkey) {
+                const passkey = await db.retrievePasskeyInternal(
+                    req.passkey.passkeyID,
+                );
+                if (!passkey || passkey.userID !== userID) {
+                    throw new AppError(401, "Passkey authentication required");
+                }
+            } else {
+                if (
+                    !req.device ||
+                    req.device.owner !== userID ||
+                    !payload.currentPassword
+                ) {
+                    throw new AppError(
+                        401,
+                        "Current-password authentication required",
+                    );
+                }
+                const current = await verifyPassword(
+                    payload.currentPassword,
+                    user,
+                );
+                if (!current.valid) {
+                    throw new AppError(401, "Current password is incorrect");
+                }
+            }
+
+            const reused = await verifyPassword(payload.newPassword, user);
+            if (reused.valid) {
+                throw new AppError(
+                    409,
+                    "New password must be different from the current password",
+                );
+            }
+
+            const passwordHash = await hashPasswordArgon2(payload.newPassword);
+            await db.rehashPassword(userID, passwordHash);
+            res.setHeader("Cache-Control", "no-store");
+            res.sendStatus(204);
+        },
+    );
+
+    return router;
+};

package/src/server/permissions.ts

@@ -6,6 +6,24 @@
 
 import type { Permission } from "@vex-chat/types";
 
+export function canDeletePermission(
+    permissions: Permission[],
+    actorUserID: string,
+    target: Permission,
+    adminPowerLevel: number,
+): boolean {
+    if (target.userID === actorUserID) {
+        return true;
+    }
+    return permissions.some(
+        (permission) =>
+            permission.userID === actorUserID &&
+            permission.resourceID === target.resourceID &&
+            permission.powerLevel >= adminPowerLevel &&
+            permission.powerLevel > target.powerLevel,
+    );
+}
+
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).
@@ -27,7 +45,7 @@ export function hasPermission(
     minPowerLevel: number,
 ): boolean {
     return permissions.some(
-        (p) => p.resourceID === resourceID && p.powerLevel > minPowerLevel,
+        (p) => p.resourceID === resourceID && p.powerLevel >= minPowerLevel,
     );
 }
 
@@ -41,6 +59,6 @@ export function userHasPermission(
     minPowerLevel: number,
 ): boolean {
     return permissions.some(
-        (p) => p.userID === userID && p.powerLevel > minPowerLevel,
+        (p) => p.userID === userID && p.powerLevel >= minPowerLevel,
     );
 }

package/src/server/rateLimit.ts

@@ -74,15 +74,14 @@ function disableRateLimitsByEnv(): boolean {
  * versions silently collapsed all IPv4-mapped IPv6 addresses into
  * one bucket, which let attackers bypass the limiter).
  *
- * `trust proxy` must be set on the Express app (see Spire.ts) so
- * `req.ip` returns the real client address, not the immediate proxy.
+ * `trust proxy` must match the real deployment topology (see Spire.ts) so
+ * `req.ip` cannot be spoofed and does not collapse all traffic onto a proxy.
  */
 
 /**
  * Bucket requests by the real client IP, IPv6-safe.
  *
- * `req.ip` is already populated correctly because `trust proxy` is
- * set to `1` in Spire's constructor. We still run it through
+ * `req.ip` reflects the explicitly configured proxy hop count. We still run it through
  * `ipKeyGenerator` so IPv4-mapped IPv6 (`::ffff:1.2.3.4`) doesn't
  * collide with unrelated IPv6 addresses in the same /56.
  */
@@ -123,6 +122,50 @@ export const authLimiter = rateLimit({
     windowMs: 15 * 60 * 1000,
 });
 
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export const accountAuthLimiter = rateLimit({
+    keyGenerator: (req) => {
+        const body: unknown = req.body;
+        const username =
+            typeof body === "object" &&
+            body !== null &&
+            "username" in body &&
+            typeof body.username === "string"
+                ? body.username.trim().toLowerCase().slice(0, 64)
+                : "";
+        return username.length > 0
+            ? `account:${username}`
+            : `invalid:${keyByIp(req)}`;
+    },
+    legacyHeaders: false,
+    limit: 100,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export const passwordUpdateLimiter = rateLimit({
+    keyGenerator: (req) =>
+        req.user?.userID
+            ? `password:${req.user.userID}`
+            : `invalid:${keyByIp(req)}`,
+    legacyHeaders: false,
+    limit: 10,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/src/server/user.ts

@@ -24,7 +24,9 @@ import {
 import { stringify } from "uuid";
 import { z } from "zod/v4";
 
+import { MAX_ACTIVE_DEVICES_PER_USER } from "../Database.ts";
 import { msgpack } from "../utils/msgpack.ts";
+import { verifyDevicePayloadPreKeySignature } from "../utils/preKeySignature.ts";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.ts";
 
 import { AppError } from "./errors.ts";
@@ -491,6 +493,7 @@ export const getUserRouter = (
         data?: unknown,
         deviceID?: string,
     ) => void,
+    disconnectDevices?: (deviceIDs: string[]) => void,
 ) => {
     const router = express.Router();
 
@@ -581,7 +584,7 @@ export const getUserRouter = (
                 authenticatorSelection: {
                     requireResidentKey: false,
                     residentKey: "preferred",
-                    userVerification: "preferred",
+                    userVerification: "required",
                 },
                 excludeCredentials: [],
                 rpID,
@@ -675,16 +678,20 @@ export const getUserRouter = (
                     expectedChallenge: passkeyRegistration.challenge,
                     expectedOrigin,
                     expectedRPID: rpID,
-                    requireUserVerification: false,
+                    requireUserVerification: true,
                     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
                     response: parsed.data
                         .response as unknown as RegistrationResponseJSON,
                 });
             } catch (err: unknown) {
+                const requestId = crypto.randomUUID();
                 const message =
                     err instanceof Error ? err.message : String(err);
+                console.warn(
+                    `[spire] pending-device WebAuthn registration failed requestId=${requestId} message=${message}`,
+                );
                 res.status(400).send({
-                    error: "Passkey attestation invalid: " + message,
+                    error: "Passkey attestation could not be verified.",
                 });
                 return;
             }
@@ -811,6 +818,10 @@ export const getUserRouter = (
 
     router.get("/:id/permissions", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const permissions = await db.retrievePermissions(
             userDetails.userID,
             "all",
@@ -820,12 +831,20 @@ export const getUserRouter = (
 
     router.get("/:id/servers", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const servers = await db.retrieveServers(userDetails.userID);
         res.send(msgpack.encode(servers));
     });
 
     router.get("/:id/servers/bootstrap", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const payload = await db.retrieveServerChannelBootstrap(
             userDetails.userID,
         );
@@ -840,8 +859,14 @@ export const getUserRouter = (
             return;
         }
         const userDetails = getUser(req);
-        if (userDetails.userID !== device.owner) {
-            res.sendStatus(401);
+        const currentDevice = req.device;
+        if (
+            getParam(req, "userID") !== userDetails.userID ||
+            userDetails.userID !== device.owner ||
+            !currentDevice ||
+            currentDevice.owner !== userDetails.userID
+        ) {
+            res.sendStatus(403);
             return;
         }
         const deviceList = await db.retrieveUserDeviceList([
@@ -855,6 +880,7 @@ export const getUserRouter = (
         }
 
         await db.deleteDevice(device.deviceID);
+        disconnectDevices?.([device.deviceID]);
         res.sendStatus(200);
     });
 
@@ -893,9 +919,21 @@ export const getUserRouter = (
         }
 
         if (tokenValidator(stringify(token), TokenScopes.Device)) {
+            if (!(await verifyDevicePayloadPreKeySignature(deviceData))) {
+                res.status(400).send({
+                    error: "Signed prekey signature is invalid.",
+                });
+                return;
+            }
             const userDevices = await db.retrieveUserDeviceList([
                 userDetails.userID,
             ]);
+            if (userDevices.length >= MAX_ACTIVE_DEVICES_PER_USER) {
+                res.status(409).send({
+                    error: `Each account is limited to ${String(MAX_ACTIVE_DEVICES_PER_USER)} active devices. Remove an old device before adding another.`,
+                });
+                return;
+            }
             if (userDevices.length === 0) {
                 try {
                     const device = await db.createDevice(
@@ -1026,10 +1064,7 @@ export const getUserRouter = (
                 return;
             }
 
-            // New clients put the passkey proof on the requesting device.
-            // Older clients may still satisfy this with an approval-side passkey.
-            const approvedByPasskeyID =
-                pending.requesterPasskeyID ?? req.passkey?.passkeyID;
+            const approvedByPasskeyID = pending.requesterPasskeyID;
             if (approvedByPasskeyID) {
                 const passkey =
                     await db.retrievePasskeyInternal(approvedByPasskeyID);

package/src/types/express.ts

@@ -22,10 +22,9 @@ declare global {
             device?: Device;
             exp?: number;
             /**
-             * Set by `checkPasskey` middleware when the bearer token is
-             * a passkey-scoped JWT. The presence of `req.passkey`
-             * (without `req.device`) marks an admin-only request that
-             * may list/delete devices and recover/reject enrollments, but
+             * Set for a revalidated passkey-scoped JWT. The presence of
+             * `req.passkey` (without `req.device`) marks an admin-only request
+             * that may list/delete devices and recover/reject enrollments, but
              * cannot send mail or do anything device-specific.
              */
             passkey?: { passkeyID: string };

package/src/utils/authJwt.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { JwtPayload, SignOptions } from "jsonwebtoken";
+
+import jwt from "jsonwebtoken";
+
+import { getJwtSecret } from "./jwtSecret.ts";
+
+const JWT_AUDIENCE = "vex-client";
+const JWT_ISSUER = "vex-spire";
+
+export function signAuthJwt(
+    payload: Record<string, unknown>,
+    expiresIn: NonNullable<SignOptions["expiresIn"]>,
+): string {
+    return jwt.sign(payload, getJwtSecret(), {
+        algorithm: "HS256",
+        audience: JWT_AUDIENCE,
+        expiresIn,
+        issuer: JWT_ISSUER,
+    });
+}
+
+export function verifyAuthJwt(token: string): JwtPayload | string {
+    return jwt.verify(token, getJwtSecret(), {
+        algorithms: ["HS256"],
+        audience: JWT_AUDIENCE,
+        issuer: JWT_ISSUER,
+    });
+}

package/src/utils/loadEnv.ts

@@ -10,6 +10,7 @@ const REQUIRED_ENV_VARS = ["DB_TYPE", "JWT_SECRET", "SPK"] as const;
 const NORMALIZED_ENV_VARS = [
     ...REQUIRED_ENV_VARS,
     "API_PORT",
+    "SPIRE_TRUST_PROXY_HOPS",
     "SPIRE_FIPS",
     "SPIRE_PASSKEY_RP_ID",
     "SPIRE_PASSKEY_RP_NAME",
@@ -82,6 +83,9 @@ export function validateSpireRuntimeEnv(
             "JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.",
         );
     }
+    if (jwtSecret.length < 32) {
+        throw new Error("JWT_SECRET must contain at least 32 characters.");
+    }
     if (jwtSecret === spk) {
         throw new Error("JWT_SECRET must be separate from SPK.");
     }