@vex-chat/spire 3.0.1 → 4.1.0

package/src/__tests__/connectAuth.spec.ts

@@ -11,14 +11,18 @@ import type { Server } from "node:http";
 import express from "express";
 
 import { xSignAsync, xSignKeyPair, XUtils } from "@vex-chat/crypto";
-import { TokenScopes } from "@vex-chat/types";
+import {
+    MAX_FILE_UPLOAD_BASE64_LENGTH,
+    MAX_FILE_UPLOAD_BYTES,
+    MAX_FILE_UPLOAD_ENCODED_BODY_BYTES,
+    TokenScopes,
+} from "@vex-chat/types";
 
-import jwt from "jsonwebtoken";
 import { parse as uuidParse } from "uuid";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { initApp } from "../server/index.ts";
-import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
 import { msgpack } from "../utils/msgpack.ts";
 
 const originalJwtSecret = process.env["JWT_SECRET"];
@@ -74,7 +78,7 @@ describe("device connect auth", () => {
                 Uint8Array.from(uuidParse(connectToken)),
                 signKeys.secretKey,
             );
-            const token = jwt.sign({ user }, getJwtSecret());
+            const token = signAuthJwt({ scope: "user", user }, "5m");
 
             const res = await fetch(
                 `http://127.0.0.1:${String(address.port)}/device/${device.deviceID}/connect`,
@@ -97,6 +101,144 @@ describe("device connect auth", () => {
             await close(server);
         }
     });
+
+    it("does not let a passkey-scoped token enter regular account routes", async () => {
+        process.env["JWT_SECRET"] = "test-jwt-secret";
+        const db = {
+            retrievePasskeyInternal: () => Promise.resolve(null),
+        } as unknown as Database;
+        const app = express();
+        initApp(
+            app,
+            db,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const token = signAuthJwt(
+                {
+                    passkey: { passkeyID: "passkey-a" },
+                    scope: "passkey",
+                    user,
+                },
+                "5m",
+            );
+
+            const res = await fetch(
+                `http://127.0.0.1:${String(address.port)}/server/server-a`,
+                { headers: { Authorization: `Bearer ${token}` } },
+            );
+
+            expect(res.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    });
+
+    it("limits the default development CORS policy to local app origins", async () => {
+        const originalCorsOrigins = process.env["CORS_ORIGINS"];
+        delete process.env["CORS_ORIGINS"];
+        const app = express();
+        initApp(
+            app,
+            {} as Database,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const url = `http://127.0.0.1:${String(address.port)}/server/server-a`;
+            const preflightHeaders = {
+                "Access-Control-Request-Method": "GET",
+            };
+            const blocked = await fetch(url, {
+                headers: {
+                    ...preflightHeaders,
+                    Origin: "https://attacker.example",
+                },
+                method: "OPTIONS",
+            });
+            const allowed = await fetch(url, {
+                headers: {
+                    ...preflightHeaders,
+                    Origin: "http://localhost:5180",
+                },
+                method: "OPTIONS",
+            });
+
+            expect(
+                blocked.headers.get("access-control-allow-origin"),
+            ).toBeNull();
+            expect(allowed.headers.get("access-control-allow-origin")).toBe(
+                "http://localhost:5180",
+            );
+        } finally {
+            if (originalCorsOrigins === undefined) {
+                delete process.env["CORS_ORIGINS"];
+            } else {
+                process.env["CORS_ORIGINS"] = originalCorsOrigins;
+            }
+            await close(server);
+        }
+    });
+
+    it("accepts a fallback upload body above the default parser limit", async () => {
+        expect(MAX_FILE_UPLOAD_BASE64_LENGTH).toBe(
+            4 * Math.ceil(MAX_FILE_UPLOAD_BYTES / 3),
+        );
+        expect(MAX_FILE_UPLOAD_ENCODED_BODY_BYTES).toBeGreaterThan(
+            MAX_FILE_UPLOAD_BASE64_LENGTH,
+        );
+
+        const encodedFileLength = 20 * 1024 * 1024 + 1;
+        expect(encodedFileLength).toBeLessThan(MAX_FILE_UPLOAD_BASE64_LENGTH);
+        const app = express();
+        initApp(
+            app,
+            {} as Database,
+            () => false,
+            xSignKeyPair(),
+            () => {},
+        );
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const response = await fetch(
+                `http://127.0.0.1:${String(address.port)}/file/json`,
+                {
+                    body: msgpack.encode({
+                        file: "A".repeat(encodedFileLength),
+                        nonce: "a".repeat(48),
+                        owner: "device-a",
+                    }),
+                    headers: { "Content-Type": "application/msgpack" },
+                    method: "POST",
+                },
+            );
+
+            // Parsing succeeded; authentication is the next middleware.
+            expect(response.status).toBe(401);
+        } finally {
+            await close(server);
+        }
+    }, 15_000);
 });
 
 function close(server: Server): Promise<void> {

package/src/__tests__/deviceTokenRevalidation.spec.ts

@@ -4,13 +4,14 @@
  * Commercial licenses available at vex.wtf
  */
 
+import type { Database } from "../Database.ts";
 import type { Device, User } from "@vex-chat/types";
 import type express from "express";
 
-import jwt from "jsonwebtoken";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { createCheckDevice } from "../server/index.ts";
+import { createCheckDevice, createCheckPasskey } from "../server/index.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
 
 const jwtSecret = "test-jwt-secret";
 
@@ -29,6 +30,8 @@ const device: Device = {
     signKey: "sign-key-a",
 };
 
+const passkeyID = "passkey-a";
+
 function makeReq(token: string, reqUser: undefined | User = user) {
     return {
         headers: { "x-device-token": token },
@@ -37,7 +40,7 @@ function makeReq(token: string, reqUser: undefined | User = user) {
 }
 
 function makeToken(tokenDevice: Device = device): string {
-    return jwt.sign({ device: tokenDevice }, jwtSecret);
+    return signAuthJwt({ device: tokenDevice, scope: "device" }, "5m");
 }
 
 describe("createCheckDevice", () => {
@@ -102,3 +105,54 @@ describe("createCheckDevice", () => {
         expect(req.device).toBeUndefined();
     });
 });
+
+describe("createCheckPasskey", () => {
+    function makePasskeyReq(reqUser: User = user) {
+        return {
+            bearerToken: "passkey-token",
+            headers: {},
+            passkey: { passkeyID },
+            user: reqUser,
+        } as unknown as express.Request;
+    }
+
+    function makePasskeyDb(row: null | { userID: string }) {
+        return {
+            retrievePasskeyInternal: vi.fn(() => Promise.resolve(row)),
+        } as unknown as Pick<Database, "retrievePasskeyInternal">;
+    }
+
+    it("keeps a passkey session while its credential remains bound", async () => {
+        const db = makePasskeyDb({ userID: user.userID });
+        const req = makePasskeyReq();
+        const next = vi.fn();
+
+        await createCheckPasskey(db)(req, {} as express.Response, next);
+
+        expect(req.passkey).toEqual({ passkeyID });
+        expect(req.user).toEqual(user);
+        expect(db.retrievePasskeyInternal).toHaveBeenCalledWith(passkeyID);
+        expect(next).toHaveBeenCalledOnce();
+    });
+
+    it("revokes a passkey session as soon as its credential is removed", async () => {
+        const db = makePasskeyDb(null);
+        const req = makePasskeyReq();
+
+        await createCheckPasskey(db)(req, {} as express.Response, vi.fn());
+
+        expect(req.bearerToken).toBeUndefined();
+        expect(req.passkey).toBeUndefined();
+        expect(req.user).toBeUndefined();
+    });
+
+    it("rejects a passkey credential bound to a different account", async () => {
+        const db = makePasskeyDb({ userID: "user-b" });
+        const req = makePasskeyReq();
+
+        await createCheckPasskey(db)(req, {} as express.Response, vi.fn());
+
+        expect(req.passkey).toBeUndefined();
+        expect(req.user).toBeUndefined();
+    });
+});

package/src/__tests__/passkeyDevices.spec.ts

@@ -0,0 +1,94 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Device, User } from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { describe, expect, it, vi } from "vitest";
+
+import { getPasskeyDeviceRouter } from "../server/passkeyDevices.ts";
+
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "user-a",
+    username: "alice",
+};
+
+const device: Device = {
+    deleted: false,
+    deviceID: "device-a",
+    lastLogin: new Date(0).toISOString(),
+    name: "desktop",
+    owner: user.userID,
+    signKey: "a".repeat(64),
+};
+
+describe("passkey device administration", () => {
+    it("disconnects a device immediately after deleting it", async () => {
+        const deleteDevice = vi.fn(() => Promise.resolve());
+        const db = {
+            deleteDevice,
+            retrieveDevice: vi.fn((deviceID: string) =>
+                Promise.resolve(deviceID === device.deviceID ? device : null),
+            ),
+        } as unknown as Database;
+        const disconnectDevices = vi.fn();
+        const notify = vi.fn();
+        const app = express();
+        app.use((req, _res, next) => {
+            req.passkey = { passkeyID: "passkey-a" };
+            req.user = user;
+            next();
+        });
+        app.use(getPasskeyDeviceRouter(db, notify, disconnectDevices));
+        const server = await listen(app);
+
+        try {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                throw new Error("Expected TCP listener.");
+            }
+            const response = await fetch(
+                `http://127.0.0.1:${String(address.port)}/user/${user.userID}/passkey/devices/${device.deviceID}`,
+                { method: "DELETE" },
+            );
+
+            expect(response.status).toBe(200);
+            expect(deleteDevice).toHaveBeenCalledWith(device.deviceID);
+            expect(disconnectDevices).toHaveBeenCalledWith([device.deviceID]);
+            expect(notify).toHaveBeenCalledWith(
+                user.userID,
+                "deviceListChanged",
+                expect.any(String),
+            );
+        } finally {
+            await close(server);
+        }
+    });
+});
+
+function close(server: Server): Promise<void> {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+
+function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}

package/src/__tests__/passkeys.spec.ts

@@ -180,7 +180,7 @@ describe("Database passkeys", () => {
 
     describe("markPasskeyUsed", () => {
         it("bumps the signature counter and lastUsedAt timestamp", async () => {
-            expect.assertions(3);
+            expect.assertions(5);
             await withDb(async (db) => {
                 const created = await db.createPasskey(
                     userID,
@@ -191,13 +191,18 @@ describe("Database passkeys", () => {
                     samplePasskey.transports,
                 );
 
-                await db.markPasskeyUsed(created.passkeyID, 42);
+                await expect(
+                    db.markPasskeyUsed(created.passkeyID, 0, 42),
+                ).resolves.toBe(true);
                 const row = await db.retrievePasskeyInternal(created.passkeyID);
 
                 expect(row).not.toBeNull();
                 if (row === null) return;
                 expect(row.signCount).toBe(42);
                 expect(row.lastUsedAt).not.toBeNull();
+                await expect(
+                    db.markPasskeyUsed(created.passkeyID, 0, 43),
+                ).resolves.toBe(false);
             });
         });
     });

package/src/__tests__/password.spec.ts

@@ -0,0 +1,223 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import {
+    afterAll,
+    afterEach,
+    beforeAll,
+    describe,
+    expect,
+    it,
+    vi,
+} from "vitest";
+
+import { hashPasswordArgon2, verifyPassword } from "../Database.ts";
+import { errorHandler } from "../server/errors.ts";
+import { getPasswordRouter } from "../server/password.ts";
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const otherUserID = "93ce482b-a0f2-4f6e-b1df-3aed61073552";
+const passkeyID = "passkey-1";
+const initialPassword = "This is the original password";
+const replacementPassword = "This is the replacement password";
+const servers: Array<{ close: () => void }> = [];
+const originalDisableRateLimits = process.env["SPIRE_DISABLE_RATE_LIMITS"];
+let initialPasswordHash = "";
+
+beforeAll(async () => {
+    process.env["SPIRE_DISABLE_RATE_LIMITS"] = "true";
+    initialPasswordHash = await hashPasswordArgon2(initialPassword);
+});
+
+afterEach(() => {
+    for (const server of servers.splice(0)) server.close();
+});
+
+afterAll(() => {
+    if (originalDisableRateLimits === undefined) {
+        delete process.env["SPIRE_DISABLE_RATE_LIMITS"];
+    } else {
+        process.env["SPIRE_DISABLE_RATE_LIMITS"] = originalDisableRateLimits;
+    }
+});
+
+describe("verifyPassword", () => {
+    it.each(["not-an-argon2-hash", "pbkdf2$100000$salt$hash"])(
+        "fails closed for an unsupported stored hash: %s",
+        async (passwordHash) => {
+            await expect(
+                verifyPassword(initialPassword, { passwordHash }),
+            ).resolves.toEqual({ needsRehash: false, valid: false });
+        },
+    );
+});
+
+describe("PATCH /user/:id/password", () => {
+    it("changes a password after approved-device and current-password proof", async () => {
+        const harness = await mountPasswordRouter("device");
+        const response = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(204);
+        expect(harness.rehashPassword).toHaveBeenCalledOnce();
+        await expectPassword(harness.passwordHash(), replacementPassword, true);
+        await expectPassword(harness.passwordHash(), initialPassword, false);
+    });
+
+    it("rejects missing or incorrect current-password proof", async () => {
+        const harness = await mountPasswordRouter("device");
+        const missing = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+        const incorrect = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: "This is definitely not the password",
+            newPassword: replacementPassword,
+        });
+
+        expect(missing.status).toBe(401);
+        expect(incorrect.status).toBe(401);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+
+    it("resets a password after fresh passkey proof", async () => {
+        const harness = await mountPasswordRouter("passkey");
+        const response = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(204);
+        await expectPassword(harness.passwordHash(), replacementPassword, true);
+    });
+
+    it("rejects passkeys that are no longer bound to the account", async () => {
+        const harness = await mountPasswordRouter("passkey", false);
+        const response = await patchPassword(harness.baseUrl, userID, {
+            newPassword: replacementPassword,
+        });
+
+        expect(response.status).toBe(401);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+
+    it("rejects cross-account targeting, reuse, and common passwords", async () => {
+        const harness = await mountPasswordRouter("device");
+        const crossAccount = await patchPassword(harness.baseUrl, otherUserID, {
+            currentPassword: initialPassword,
+            newPassword: replacementPassword,
+        });
+        const reused = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: initialPassword,
+        });
+        const common = await patchPassword(harness.baseUrl, userID, {
+            currentPassword: initialPassword,
+            newPassword: "passwordpassword",
+        });
+
+        expect(crossAccount.status).toBe(403);
+        expect(reused.status).toBe(409);
+        expect(common.status).toBe(400);
+        expect(harness.rehashPassword).not.toHaveBeenCalled();
+    });
+});
+
+async function expectPassword(
+    passwordHash: string,
+    password: string,
+    expected: boolean,
+): Promise<void> {
+    const result = await verifyPassword(password, { passwordHash });
+    expect(result.valid).toBe(expected);
+}
+
+async function mountPasswordRouter(
+    auth: "device" | "passkey",
+    passkeyExists = true,
+): Promise<{
+    baseUrl: string;
+    passwordHash: () => string;
+    rehashPassword: ReturnType<typeof vi.fn>;
+}> {
+    let passwordHash = initialPasswordHash;
+    const rehashPassword = vi.fn((_userID: string, nextHash: string) => {
+        passwordHash = nextHash;
+        return Promise.resolve();
+    });
+    const db = {
+        rehashPassword,
+        retrievePasskeyInternal: vi.fn(() =>
+            Promise.resolve(passkeyExists ? { passkeyID, userID } : null),
+        ),
+        retrieveUser: vi.fn((identifier: string) =>
+            Promise.resolve(
+                identifier === userID
+                    ? {
+                          lastSeen: new Date().toISOString(),
+                          passwordHash,
+                          userID,
+                          username: "alice",
+                      }
+                    : null,
+            ),
+        ),
+    } as unknown as Database;
+
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        req.user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        if (auth === "device") {
+            req.device = {
+                deleted: false,
+                deviceID: "device-1",
+                lastLogin: new Date().toISOString(),
+                name: "Test device",
+                owner: userID,
+                signKey: "a".repeat(64),
+            };
+        } else {
+            req.passkey = { passkeyID };
+        }
+        next();
+    });
+    app.use(getPasswordRouter(db));
+    app.use(errorHandler());
+
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            const { port } = server.address() as AddressInfo;
+            resolve({
+                baseUrl: `http://127.0.0.1:${String(port)}`,
+                passwordHash: () => passwordHash,
+                rehashPassword,
+            });
+        });
+        servers.push(server);
+    });
+}
+
+async function patchPassword(
+    baseUrl: string,
+    routeUserID: string,
+    body: { currentPassword?: string; newPassword: string },
+): Promise<Response> {
+    return fetch(`${baseUrl}/user/${routeUserID}/password`, {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        method: "PATCH",
+    });
+}

package/src/__tests__/permissions.spec.ts

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Permission } from "@vex-chat/types";
+
+import { describe, expect, it } from "vitest";
+
+import {
+    canDeletePermission,
+    hasPermission,
+    userHasPermission,
+} from "../server/permissions.ts";
+
+function permission(
+    userID: string,
+    powerLevel: number,
+    permissionID = `${userID}-${String(powerLevel)}`,
+): Permission {
+    return {
+        permissionID,
+        powerLevel,
+        resourceID: "server-a",
+        resourceType: "server",
+        userID,
+    };
+}
+
+describe("server permissions", () => {
+    it("treats a minimum power level as inclusive", () => {
+        const permissions = [permission("alice", 50)];
+        expect(hasPermission(permissions, "server-a", 50)).toBe(true);
+        expect(userHasPermission(permissions, "alice", 50)).toBe(true);
+    });
+
+    it("does not let an ordinary member remove another user's permission", () => {
+        const actor = permission("alice", 0);
+        const target = permission("bob", 0);
+        expect(canDeletePermission([actor], "alice", target, 50)).toBe(false);
+    });
+
+    it("allows self-removal and higher-power moderation", () => {
+        const own = permission("alice", 0);
+        const admin = permission("admin", 100);
+        expect(canDeletePermission([own], "alice", own, 50)).toBe(true);
+        expect(canDeletePermission([admin], "admin", own, 50)).toBe(true);
+    });
+});