@vex-chat/spire 3.0.1 → 4.1.0

package/src/__tests__/Database.spec.ts

@@ -5,7 +5,7 @@
  */
 
 import type { SpireOptions } from "../Spire.ts";
-import type { DevicePayload, MailWS, PreKeysWS } from "@vex-chat/types";
+import type { MailWS, PreKeysWS, RegistrationPayload } from "@vex-chat/types";
 
 import { XUtils } from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
@@ -13,7 +13,11 @@ import { MailType } from "@vex-chat/types";
 import * as uuid from "uuid";
 import { describe, expect, it, vi } from "vitest";
 
-import { Database } from "../Database.ts";
+import {
+    Database,
+    MAX_ACTIVE_DEVICES_PER_USER,
+    validateAccountPassword,
+} from "../Database.ts";
 
 // vi.mock is hoisted above all imports automatically.
 // Minimal stubs for uuid functions used by spire src: v4, parse, stringify.
@@ -67,8 +71,9 @@ describe("Database", () => {
     const devicePayload = (
         deviceName: string,
         signKey: string,
-    ): DevicePayload => ({
+    ): RegistrationPayload => ({
         deviceName,
+        intent: "create-account",
         preKey: testSQLPreKey.publicKey,
         preKeyIndex: 1,
         preKeySignature: testSQLPreKey.signature,
@@ -81,6 +86,32 @@ describe("Database", () => {
         dbType: "sqlite3mem",
     };
 
+    describe("account password policy", () => {
+        it("accepts long passphrases without composition requirements", () => {
+            expect(
+                validateAccountPassword("four simple words make a password"),
+            ).toBeNull();
+        });
+
+        it("rejects short, common, repeated, and username-matching values", () => {
+            expect(validateAccountPassword("thirteen-char!")).toContain(
+                "at least 15",
+            );
+            expect(validateAccountPassword("passwordpassword")).toBe(
+                "Choose a less common password.",
+            );
+            expect(validateAccountPassword("z".repeat(20))).toBe(
+                "Choose a less common password.",
+            );
+            expect(
+                validateAccountPassword(
+                    "long-account-name",
+                    "Long-Account-Name",
+                ),
+            ).toBe("Choose a less common password.");
+        });
+    });
+
     describe("createUser", () => {
         it("requires a password for new accounts", async () => {
             expect.assertions(3);
@@ -109,6 +140,98 @@ describe("Database", () => {
                 });
             });
         });
+
+        it("rolls back the user when initial device creation fails", async () => {
+            expect.assertions(5);
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            const signKey = "c".repeat(64);
+                            const [first, firstError] =
+                                await provider.createUser(
+                                    new Uint8Array(16).fill(1),
+                                    {
+                                        ...devicePayload("desktop", signKey),
+                                        password:
+                                            "correct horse battery staple",
+                                    },
+                                );
+                            expect(firstError).toBeNull();
+                            expect(first).not.toBeNull();
+
+                            const [second, secondError] =
+                                await provider.createUser(
+                                    new Uint8Array(16).fill(2),
+                                    {
+                                        ...devicePayload("mobile", signKey),
+                                        password:
+                                            "correct horse battery staple",
+                                        username: "bob",
+                                    },
+                                );
+                            expect(secondError).toBeInstanceOf(Error);
+                            expect(second).toBeNull();
+                            await expect(
+                                provider.retrieveUser("bob"),
+                            ).resolves.toBeNull();
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            await provider.close().catch(() => undefined);
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
+    });
+
+    describe("createDevice", () => {
+        it("bounds active device clusters", async () => {
+            const provider = new Database(options);
+            await new Promise<void>((resolve, reject) => {
+                provider.once("ready", () => {
+                    void (async () => {
+                        try {
+                            for (
+                                let index = 0;
+                                index < MAX_ACTIVE_DEVICES_PER_USER;
+                                index += 1
+                            ) {
+                                await provider.createDevice(
+                                    userID,
+                                    devicePayload(
+                                        `device-${String(index)}`,
+                                        index.toString(16).padStart(64, "0"),
+                                    ),
+                                );
+                            }
+
+                            await expect(
+                                provider.createDevice(
+                                    userID,
+                                    devicePayload(
+                                        "one-too-many",
+                                        "f".repeat(64),
+                                    ),
+                                ),
+                            ).rejects.toThrow("limited to 20 active devices");
+                            await provider.close();
+                            resolve();
+                        } catch (e: unknown) {
+                            await provider.close().catch(() => undefined);
+                            reject(
+                                e instanceof Error ? e : new Error(String(e)),
+                            );
+                        }
+                    })();
+                });
+            });
+        });
     });
 
     describe("saveOTK", () => {

package/src/__tests__/browserPasskeyAuthentication.spec.ts

@@ -0,0 +1,192 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Passkey, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getPasskeyRouter } from "../server/passkey.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-browser-auth",
+    username: "alice",
+};
+
+const passkey: Passkey = {
+    createdAt: new Date(0).toISOString(),
+    lastUsedAt: null,
+    name: "MacBook Touch ID",
+    passkeyID: "passkey-browser-auth",
+    transports: ["internal"],
+    userID: user.userID,
+};
+
+const originalRpID = process.env["SPIRE_PASSKEY_RP_ID"];
+const originalOrigins = process.env["SPIRE_PASSKEY_ORIGINS"];
+
+beforeEach(() => {
+    process.env["SPIRE_PASSKEY_RP_ID"] = "vex.example";
+    process.env["SPIRE_PASSKEY_ORIGINS"] = "https://vex.example";
+});
+
+afterEach(() => {
+    restoreEnv("SPIRE_PASSKEY_RP_ID", originalRpID);
+    restoreEnv("SPIRE_PASSKEY_ORIGINS", originalOrigins);
+});
+
+describe("browser passkey authentication", () => {
+    it("returns an HTTPS assertion to the original authentication request", async () => {
+        const db = {
+            retrievePasskeyInternal: vi.fn(() =>
+                Promise.resolve({ credentialID: "credential-browser-auth" }),
+            ),
+            retrievePasskeysByUser: vi.fn(() => Promise.resolve([passkey])),
+            retrieveUser: vi.fn(() => Promise.resolve(user)),
+        } as unknown as Database;
+        const app = express();
+        app.use(express.json());
+        app.use(getPasskeyRouter(db));
+        const server = await listen(app);
+
+        try {
+            const baseUrl = serverBaseUrl(server);
+            const authBeginResponse = await post(
+                `${baseUrl}/auth/passkey/begin?format=json`,
+                { username: user.username },
+            );
+            const authBegin = (await authBeginResponse.json()) as {
+                options: {
+                    challenge: string;
+                    rpId: string;
+                    vexBrowserHandoff: {
+                        browserToken: string;
+                        expiresAt: string;
+                        requestID: string;
+                    };
+                };
+                requestID: string;
+            };
+            const handoff = authBegin.options.vexBrowserHandoff;
+
+            expect(authBeginResponse.status).toBe(200);
+            expect(authBegin.options.rpId).toBe("vex.example");
+            expect(handoff.browserToken.length).toBeGreaterThanOrEqual(32);
+            expect(handoff.requestID).not.toBe(authBegin.requestID);
+
+            const wrongTokenResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/begin?format=json`,
+                { token: "x".repeat(43) },
+            );
+            expect(wrongTokenResponse.status).toBe(401);
+
+            const pendingResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(pendingResponse.status).toBe(202);
+
+            const browserBeginResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/begin?format=json`,
+                { token: handoff.browserToken },
+            );
+            const browserBegin = (await browserBeginResponse.json()) as {
+                options: {
+                    challenge: string;
+                    vexBrowserHandoff?: unknown;
+                };
+            };
+            expect(browserBeginResponse.status).toBe(200);
+            expect(browserBegin.options.challenge).toBe(
+                authBegin.options.challenge,
+            );
+            expect(browserBegin.options.vexBrowserHandoff).toBeUndefined();
+
+            const assertion = {
+                id: "credential-browser-auth",
+                response: { signature: "browser-assertion" },
+                type: "public-key",
+            };
+            const browserFinishResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/finish?format=json`,
+                { response: assertion, token: handoff.browserToken },
+            );
+            expect(browserFinishResponse.status).toBe(200);
+
+            const readyResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(readyResponse.status).toBe(200);
+            await expect(readyResponse.json()).resolves.toEqual({
+                response: assertion,
+            });
+
+            const consumeResponse = await post(
+                `${baseUrl}/auth/passkey/finish?format=json`,
+                { requestID: authBegin.requestID, response: {} },
+            );
+            expect(consumeResponse.status).toBe(400);
+
+            const replayResponse = await post(
+                `${baseUrl}/auth/passkey/browser-authentication/${handoff.requestID}/status?format=json`,
+                { token: handoff.browserToken },
+            );
+            expect(replayResponse.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+function post(url: string, body: unknown): Promise<Response> {
+    return fetch(url, {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+    });
+}
+
+function restoreEnv(name: string, value: string | undefined): void {
+    if (value === undefined) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- restores the process environment exactly
+        delete process.env[name];
+        return;
+    }
+    process.env[name] = value;
+}
+
+function serverBaseUrl(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/__tests__/browserPasskeyRegistration.spec.ts

@@ -0,0 +1,182 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getPasskeyRouter } from "../server/passkey.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+const device: Device = {
+    deleted: false,
+    deviceID: "device-a",
+    lastLogin: new Date(0).toISOString(),
+    name: "desktop",
+    owner: user.userID,
+    signKey: "a".repeat(64),
+};
+
+const originalRpID = process.env["SPIRE_PASSKEY_RP_ID"];
+const originalOrigins = process.env["SPIRE_PASSKEY_ORIGINS"];
+
+beforeEach(() => {
+    process.env["SPIRE_PASSKEY_RP_ID"] = "vex.example";
+    process.env["SPIRE_PASSKEY_ORIGINS"] = "https://vex.example";
+});
+
+afterEach(() => {
+    restoreEnv("SPIRE_PASSKEY_RP_ID", originalRpID);
+    restoreEnv("SPIRE_PASSKEY_ORIGINS", originalOrigins);
+});
+
+describe("browser passkey registration", () => {
+    it("issues a scoped browser handoff from an authenticated registration", async () => {
+        let approvedDevice: Device | null = device;
+        const db = {
+            retrieveDevice: vi.fn(() => Promise.resolve(approvedDevice)),
+            retrievePasskeysByUser: vi.fn(() => Promise.resolve([])),
+        } as unknown as Database;
+        const app = express();
+        app.use(express.json());
+        app.use((req, _res, next) => {
+            req.device = device;
+            req.user = user;
+            next();
+        });
+        app.use(getPasskeyRouter(db));
+        const server = await listen(app);
+
+        try {
+            const baseUrl = serverBaseUrl(server);
+            const createResponse = await fetch(
+                `${baseUrl}/user/${user.userID}/passkeys/register/begin?format=json`,
+                {
+                    body: JSON.stringify({ name: "MacBook Touch ID" }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const created = (await createResponse.json()) as {
+                options: {
+                    rp: { id: string };
+                    vexBrowserHandoff: {
+                        browserToken: string;
+                        expiresAt: string;
+                        requestID: string;
+                    };
+                };
+                requestID: string;
+            };
+            const handoff = created.options.vexBrowserHandoff;
+
+            expect(createResponse.status).toBe(200);
+            expect(created.options.rp.id).toBe("vex.example");
+            expect(handoff.browserToken.length).toBeGreaterThanOrEqual(32);
+            expect(new Date(handoff.expiresAt).getTime()).toBeGreaterThan(
+                Date.now(),
+            );
+            expect(handoff.requestID).not.toBe(created.requestID);
+
+            const wrongTokenResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: "x".repeat(43) }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(wrongTokenResponse.status).toBe(401);
+
+            const beginResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: handoff.browserToken }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const begin = (await beginResponse.json()) as {
+                options: { rp: { id: string } };
+            };
+            expect(beginResponse.status).toBe(200);
+            expect(begin.options.rp.id).toBe("vex.example");
+
+            const nativeFinishResponse = await fetch(
+                `${baseUrl}/user/${user.userID}/passkeys/register/finish?format=json`,
+                {
+                    body: JSON.stringify({
+                        name: "MacBook Touch ID",
+                        requestID: created.requestID,
+                        response: {},
+                    }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(nativeFinishResponse.status).toBe(404);
+
+            approvedDevice = null;
+            const revokedDeviceResponse = await fetch(
+                `${baseUrl}/auth/passkey/browser-registration/${handoff.requestID}/begin?format=json`,
+                {
+                    body: JSON.stringify({ token: handoff.browserToken }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            expect(revokedDeviceResponse.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+function restoreEnv(name: string, value: string | undefined): void {
+    if (value === undefined) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- restores the process environment exactly
+        delete process.env[name];
+        return;
+    }
+    process.env[name] = value;
+}
+
+function serverBaseUrl(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/__tests__/cliPasskeyPage.spec.ts

@@ -47,6 +47,12 @@ describe("CLI passkey page", () => {
         expect(html).toContain("Continue with your passkey.");
         expect(html).toContain("resolveTrustedApiBase");
         expect(html).toContain("Passkey link API origin is not trusted.");
+        expect(html).toContain("window.history.replaceState");
+        expect(html).toContain('mode === "register-handoff"');
+        expect(html).toContain('mode === "authenticate-handoff"');
+        expect(html).toContain('"/auth/passkey/browser-registration/"');
+        expect(html).toContain('"/auth/passkey/browser-authentication/"');
+        expect(html).toContain("action.disabled = nextBusy || completed");
         expect(html).toContain("navigator.credentials.create");
         expect(html).toContain("navigator.credentials.get");
     });