@vex-chat/spire 3.0.1 → 4.1.0

package/src/__tests__/preKeySignature.spec.ts

@@ -7,8 +7,7 @@
 import {
     setCryptoProfile,
     xBoxKeyPairAsync,
-    xConstants,
-    xEncode,
+    xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPair,
     XUtils,
@@ -25,7 +24,7 @@ async function makeSignedPreKey() {
     const signKeys = xSignKeyPair();
     const preKey = await xBoxKeyPairAsync();
     const signature = await xSignAsync(
-        xEncode(xConstants.CURVE, preKey.publicKey),
+        xPreKeySignaturePayload(preKey.publicKey, "signed"),
         signKeys.secretKey,
     );
     return { preKey, signature, signKeys };
@@ -55,6 +54,7 @@ describe("prekey signature validation", () => {
                     signature,
                 },
                 XUtils.encodeHex(signKeys.publicKey),
+                "signed",
             ),
         ).resolves.toBe(true);
     });
@@ -71,4 +71,21 @@ describe("prekey signature validation", () => {
             }),
         ).resolves.toBe(false);
     });
+
+    it("does not accept a signed prekey as a one-time prekey", async () => {
+        const { preKey, signature, signKeys } = await makeSignedPreKey();
+
+        await expect(
+            verifyPreKeyWsSignature(
+                {
+                    deviceID: "device-a",
+                    index: 1,
+                    publicKey: preKey.publicKey,
+                    signature,
+                },
+                XUtils.encodeHex(signKeys.publicKey),
+                "one-time",
+            ),
+        ).resolves.toBe(false);
+    });
 });

package/src/__tests__/serverManagement.spec.ts

@@ -0,0 +1,262 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type {
+    Channel,
+    Permission,
+    User,
+    Server as VexServer,
+} from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { xSignKeyPair, XUtils } from "@vex-chat/crypto";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import { initApp } from "../server/index.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
+import { msgpack } from "../utils/msgpack.ts";
+
+const testImage = XUtils.decodeBase64(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQABNjN9GQAAAABJRU5ErkJggg==",
+);
+
+const originalJwtSecret = process.env["JWT_SECRET"];
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "8d768e5c-55ec-4fe4-bcb2-26bdde8076d9",
+    username: "server-admin",
+};
+const member: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "3e1225e2-88bb-469f-bef3-28531da7f97a",
+    username: "group-member",
+};
+
+describe("server management routes", () => {
+    afterEach(() => {
+        if (originalJwtSecret === undefined) {
+            delete process.env["JWT_SECRET"];
+        } else {
+            process.env["JWT_SECRET"] = originalJwtSecret;
+        }
+    });
+
+    it("renames servers and channels, manages icons, and preserves one channel", async () => {
+        process.env["JWT_SECRET"] = "server-management-test-secret";
+        const db = new Database({ dbType: "sqlite3mem" });
+        await ready(db);
+        await db["db"]
+            .insertInto("users")
+            .values(
+                [user, member].map((entry) => ({
+                    ...entry,
+                    passwordHash: "not-used-by-this-test",
+                })),
+            )
+            .execute();
+        const created = await db.createServer("Before", user.userID);
+        const memberPermission = await db.createPermission(
+            member.userID,
+            "server",
+            created.serverID,
+            0,
+        );
+        const ownerPermission = (
+            await db.retrievePermissionsByResourceID(created.serverID)
+        ).find((permission) => permission.userID === user.userID);
+        expect(ownerPermission).toBeDefined();
+        const notify = vi.fn();
+        const app = express();
+        initApp(app, db, () => false, xSignKeyPair(), notify);
+        const listener = await listen(app);
+
+        try {
+            const origin = serverOrigin(listener);
+            const headers = {
+                Authorization: `Bearer ${signAuthJwt({ scope: "user", user }, "5m")}`,
+                "Content-Type": "application/msgpack",
+            };
+
+            const createServer = await fetch(`${origin}/servers`, {
+                body: msgpack.encode({ name: "Café 作戦" }),
+                headers,
+                method: "POST",
+            });
+            expect(createServer.status).toBe(200);
+            expect(await decode<VexServer>(createServer)).toMatchObject({
+                name: "Café 作戦",
+            });
+
+            const renameServer = await fetch(
+                `${origin}/server/${created.serverID}`,
+                {
+                    body: msgpack.encode({ name: "After" }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(renameServer.status).toBe(200);
+            expect(await decode<VexServer>(renameServer)).toMatchObject({
+                name: "After",
+                serverID: created.serverID,
+            });
+
+            const promoteMember = await fetch(
+                `${origin}/permission/${memberPermission.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 50 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(promoteMember.status).toBe(200);
+            expect(await decode<Permission>(promoteMember)).toMatchObject({
+                permissionID: memberPermission.permissionID,
+                powerLevel: 50,
+            });
+
+            const memberHeaders = {
+                Authorization: `Bearer ${signAuthJwt({ scope: "user", user: member }, "5m")}`,
+                "Content-Type": "application/msgpack",
+            };
+            const moderatorCannotChangeRoles = await fetch(
+                `${origin}/permission/${ownerPermission!.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 100 }),
+                    headers: memberHeaders,
+                    method: "PATCH",
+                },
+            );
+            expect(moderatorCannotChangeRoles.status).toBe(403);
+
+            const ownerCannotChangeOwnRole = await fetch(
+                `${origin}/permission/${ownerPermission!.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 50 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(ownerCannotChangeOwnRole.status).toBe(400);
+
+            const unsupportedRole = await fetch(
+                `${origin}/permission/${memberPermission.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 25 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(unsupportedRole.status).toBe(400);
+
+            const [general] = await db.retrieveChannels(created.serverID);
+            expect(general).toBeDefined();
+            const renameChannel = await fetch(
+                `${origin}/channel/${general!.channelID}`,
+                {
+                    body: msgpack.encode({ name: "announcements" }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(renameChannel.status).toBe(200);
+            expect(await decode<Channel>(renameChannel)).toMatchObject({
+                name: "announcements",
+            });
+
+            const lastChannel = await fetch(
+                `${origin}/channel/${general!.channelID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(lastChannel.status).toBe(409);
+
+            const extra = await db.createChannel("extra", created.serverID);
+            const deleteExtra = await fetch(
+                `${origin}/channel/${extra.channelID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(deleteExtra.status).toBe(200);
+
+            const setIcon = await fetch(
+                `${origin}/server-icon/${created.serverID}/json`,
+                {
+                    body: msgpack.encode({
+                        file: XUtils.encodeBase64(testImage),
+                    }),
+                    headers,
+                    method: "POST",
+                },
+            );
+            expect(setIcon.status).toBe(200);
+            const withIcon = await decode<VexServer>(setIcon);
+            expect(withIcon.icon).toEqual(expect.any(String));
+
+            const iconResponse = await fetch(
+                `${origin}/server-icon/${withIcon.icon!}`,
+            );
+            expect(iconResponse.status).toBe(200);
+            expect(iconResponse.headers.get("cache-control")).toContain(
+                "immutable",
+            );
+
+            const removeIcon = await fetch(
+                `${origin}/server-icon/${created.serverID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(removeIcon.status).toBe(200);
+            expect((await decode<VexServer>(removeIcon)).icon).toBeUndefined();
+            expect(notify).toHaveBeenCalledWith(
+                user.userID,
+                "serverChange",
+                expect.any(String),
+                created.serverID,
+            );
+        } finally {
+            await close(listener);
+            await db.close();
+        }
+    });
+});
+
+async function close(server: Server): Promise<void> {
+    await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+            if (error) reject(error);
+            else resolve();
+        });
+    });
+}
+
+async function decode<T>(response: Response): Promise<T> {
+    return msgpack.decode(new Uint8Array(await response.arrayBuffer())) as T;
+}
+
+async function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+async function ready(db: Database): Promise<void> {
+    await new Promise<void>((resolve, reject) => {
+        db.once("ready", resolve);
+        db.once("error", reject);
+    });
+}
+
+function serverOrigin(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/db/schema.ts

@@ -276,10 +276,8 @@ export type ServiceMetricUpdate = Updateable<ServiceMetricsTable>;
 
 export type UserRow = Selectable<UsersTable>;
 export interface UsersTable {
-    hashAlgo: string;
     lastSeen: string;
     passwordHash: string;
-    passwordSalt: string;
     userID: string;
     username: string;
 }

package/src/migrations/2026-04-06_initial-schema.ts

@@ -31,11 +31,10 @@ export async function up(db: Kysely<unknown>): Promise<void> {
     await db.schema
         .createTable("users")
         .ifNotExists()
-        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey())
-        .addColumn("username", "varchar(255)", (cb) => cb.unique())
-        .addColumn("passwordHash", "text")
-        .addColumn("passwordSalt", "text")
-        .addColumn("lastSeen", "text")
+        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey().notNull())
+        .addColumn("username", "varchar(255)", (cb) => cb.unique().notNull())
+        .addColumn("passwordHash", "text", (cb) => cb.notNull())
+        .addColumn("lastSeen", "text", (cb) => cb.notNull())
         .execute();
 
     await db.schema

package/src/migrations/2026-07-14_query-indexes.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropIndex("channels_serverID_idx").ifExists().execute();
+    await db.schema.dropIndex("devices_owner_deleted_idx").ifExists().execute();
+    await db.schema.dropIndex("permissions_user_type_idx").ifExists().execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createIndex("devices_owner_deleted_idx")
+        .ifNotExists()
+        .on("devices")
+        .columns(["owner", "deleted"])
+        .execute();
+    await db.schema
+        .createIndex("channels_serverID_idx")
+        .ifNotExists()
+        .on("channels")
+        .column("serverID")
+        .execute();
+    await db.schema
+        .createIndex("permissions_user_type_idx")
+        .ifNotExists()
+        .on("permissions")
+        .columns(["userID", "resourceType"])
+        .execute();
+}

package/src/server/avatar.ts

@@ -21,13 +21,20 @@ import { getParam, getUser } from "./utils.ts";
 import { ALLOWED_IMAGE_TYPES, protect } from "./index.ts";
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+const MAX_AVATAR_BYTES = 5 * 1024 * 1024;
+const avatarUpload = multer({
+    limits: { fields: 1, files: 1, fileSize: MAX_AVATAR_BYTES, parts: 2 },
+});
 
 // Avatars are public, unencrypted images. The body for the JSON path is just a
 // base64-encoded image; nothing else. Do NOT reuse FilePayloadSchema here —
 // that schema is for encrypted user-file uploads and requires nonce/owner/signed,
 // which the avatar client never sends (and shouldn't).
 const avatarJsonPayload = z.object({
-    file: z.string().min(1),
+    file: z
+        .string()
+        .min(1)
+        .max(Math.ceil((MAX_AVATAR_BYTES * 4) / 3) + 4),
 });
 
 export const getAvatarRouter = () => {
@@ -47,6 +54,7 @@ export const getAvatarRouter = () => {
         }
         res.set("Content-type", typeDetails.mime);
         res.set("Cache-control", "public, max-age=31536000");
+        res.set("Cross-Origin-Resource-Policy", "cross-origin");
 
         const stream = fs.createReadStream(filePath);
         stream.on("error", (_err) => {
@@ -56,7 +64,7 @@ export const getAvatarRouter = () => {
         stream.pipe(res);
     });
 
-    router.post("/:userID/json", protect, async (req, res) => {
+    router.post("/:userID/json", uploadLimiter, protect, async (req, res) => {
         const parsed = avatarJsonPayload.safeParse(req.body);
         if (!parsed.success) {
             res.status(400).json({
@@ -73,13 +81,27 @@ export const getAvatarRouter = () => {
             res.sendStatus(401);
             return;
         }
+        if (getParam(req, "userID") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
 
-        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        let buf: Buffer;
+        try {
+            buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        } catch {
+            res.status(400).send({ error: "Avatar must be valid base64." });
+            return;
+        }
+        if (buf.byteLength > MAX_AVATAR_BYTES) {
+            res.sendStatus(413);
+            return;
+        }
         const mimeType = await fileTypeFromBuffer(buf);
         if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
             res.status(400).send({
                 error:
-                    "Unsupported file type. Expected jpeg, png, gif, apng, avif, or svg but received " +
+                    "Unsupported file type. Expected jpeg, png, gif, apng, avif, or webp but received " +
                     String(mimeType?.ext),
             });
             return;
@@ -99,7 +121,7 @@ export const getAvatarRouter = () => {
         "/:userID",
         uploadLimiter,
         protect,
-        multer().single("avatar"),
+        avatarUpload.single("avatar"),
         async (req, res) => {
             const userDetails = getUser(req);
             const deviceDetails = req.device;
@@ -108,6 +130,10 @@ export const getAvatarRouter = () => {
                 res.sendStatus(401);
                 return;
             }
+            if (getParam(req, "userID") !== userDetails.userID) {
+                res.sendStatus(403);
+                return;
+            }
 
             if (!req.file) {
                 res.sendStatus(400);
@@ -118,7 +144,7 @@ export const getAvatarRouter = () => {
             if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
                 res.status(400).send({
                     error:
-                        "Unsupported file type. Expected jpeg, png, gif, apng, avif, or svg but received " +
+                        "Unsupported file type. Expected jpeg, png, gif, apng, avif, or webp but received " +
                         String(mimeType?.ext),
                 });
                 return;

package/src/server/cliPasskeyPage.ts

@@ -150,6 +150,13 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
         "use strict";
 
         var params = new URLSearchParams(window.location.hash.slice(1));
+        if (window.location.hash) {
+            window.history.replaceState(
+                null,
+                "",
+                window.location.pathname + window.location.search,
+            );
+        }
         var action = document.getElementById("action");
         var statusEl = document.getElementById("status");
         var titleEl = document.getElementById("title");
@@ -158,6 +165,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
         var startupError = null;
         var apiBase = window.location.origin;
         var busy = false;
+        var completed = false;
 
         try {
             apiBase = resolveTrustedApiBase(params.get("api"));
@@ -165,11 +173,16 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             startupError = err;
         }
 
-        if (mode === "register") {
+        if (mode === "register" || mode === "register-handoff") {
             titleEl.textContent = "Create a passkey for Vex.";
             copyEl.textContent = "This adds a passkey to your Vex account.";
             action.textContent = "Create passkey";
             setStatus("Ready to create passkey.");
+        } else if (mode === "authenticate-handoff") {
+            titleEl.textContent = "Continue signing in to Vex.";
+            copyEl.textContent =
+                "Use your passkey here, then return to the Vex desktop app.";
+            setStatus("Ready to verify passkey.");
         } else {
             setStatus("Ready to verify passkey.");
         }
@@ -190,7 +203,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
 
         function setBusy(nextBusy) {
             busy = nextBusy;
-            action.disabled = nextBusy;
+            action.disabled = nextBusy || completed;
         }
 
         function apiUrl(path) {
@@ -271,12 +284,19 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
                 }
                 if (mode === "register") {
                     await registerPasskey();
+                } else if (mode === "register-handoff") {
+                    await registerPasskeyWithHandoff();
+                } else if (mode === "authenticate-handoff") {
+                    await authenticatePasskeyWithHandoff();
                 } else {
                     await recoverWithPasskey();
                 }
             } catch (err) {
                 setStatus(errorMessage(err), "error");
-                action.textContent = mode === "register" ? "Try again" : "Retry passkey";
+                action.textContent =
+                    mode === "register" || mode === "register-handoff"
+                        ? "Try again"
+                        : "Retry passkey";
             } finally {
                 setBusy(false);
             }
@@ -297,15 +317,8 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
                 body: { name: name },
                 token: token,
             });
-            var credentialOptions = makeCreationOptions(begin.options);
-
             setStatus("Waiting for browser passkey prompt...");
-            var credential = await navigator.credentials.create({
-                publicKey: credentialOptions,
-            });
-            if (!credential) {
-                throw new Error("No passkey was created.");
-            }
+            var credential = await createPasskeyCredential(begin.options);
 
             setStatus("Saving passkey...");
             await apiRequest("/user/" + encodeURIComponent(userID) + "/passkeys/register/finish", {
@@ -319,6 +332,90 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             setStatus("Passkey saved. Return to the Vex CLI.", "success");
             titleEl.textContent = "Passkey saved.";
             copyEl.textContent = "The CLI can finish connecting now.";
+            completed = true;
+            action.textContent = "Done";
+        }
+
+        async function registerPasskeyWithHandoff() {
+            var token = requiredParam("token");
+            var requestID = requiredParam("request");
+
+            setStatus("Requesting a one-time passkey challenge...");
+            var begin = await apiRequest(
+                "/auth/passkey/browser-registration/" +
+                    encodeURIComponent(requestID) +
+                    "/begin",
+                { body: { token: token } },
+            );
+
+            setStatus("Waiting for browser passkey prompt...");
+            var credential = await createPasskeyCredential(begin.options);
+
+            setStatus("Saving passkey...");
+            await apiRequest(
+                "/auth/passkey/browser-registration/" +
+                    encodeURIComponent(requestID) +
+                    "/finish",
+                {
+                    body: {
+                        response: registrationResponseJSON(credential),
+                        token: token,
+                    },
+                },
+            );
+            setStatus("Passkey saved. You can close this page.", "success");
+            titleEl.textContent = "Passkey saved.";
+            copyEl.textContent = "Vex has updated your account.";
+            completed = true;
+            action.textContent = "Done";
+        }
+
+        async function createPasskeyCredential(options) {
+            var credential = await navigator.credentials.create({
+                publicKey: makeCreationOptions(options),
+            });
+            if (!credential) {
+                throw new Error("No passkey was created.");
+            }
+            return credential;
+        }
+
+        async function authenticatePasskeyWithHandoff() {
+            var token = requiredParam("token");
+            var requestID = requiredParam("request");
+
+            setStatus("Requesting a one-time passkey challenge...");
+            var begin = await apiRequest(
+                "/auth/passkey/browser-authentication/" +
+                    encodeURIComponent(requestID) +
+                    "/begin",
+                { body: { token: token } },
+            );
+
+            setStatus("Waiting for browser passkey prompt...");
+            var credential = await navigator.credentials.get({
+                publicKey: makeRequestOptions(begin.options),
+            });
+            if (!credential) {
+                throw new Error("No passkey was returned.");
+            }
+
+            setStatus("Returning verification to Vex...");
+            await apiRequest(
+                "/auth/passkey/browser-authentication/" +
+                    encodeURIComponent(requestID) +
+                    "/finish",
+                {
+                    body: {
+                        response: authenticationResponseJSON(credential),
+                        token: token,
+                    },
+                },
+            );
+            setStatus("Passkey verified. You can close this page.", "success");
+            titleEl.textContent = "Passkey verified.";
+            copyEl.textContent = "Return to Vex to finish signing in.";
+            completed = true;
             action.textContent = "Done";
         }
 
@@ -371,6 +468,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             setStatus("CLI device recovered. Return to the Vex CLI.", "success");
             titleEl.textContent = "Device signed in.";
             copyEl.textContent = "The CLI can finish connecting now.";
+            completed = true;
             action.textContent = "Done";
         }
 

package/src/server/errors.ts

@@ -35,6 +35,7 @@ import type { ErrorRequestHandler } from "express";
 
 import { randomUUID } from "node:crypto";
 
+import multer from "multer";
 import { ZodError } from "zod/v4";
 
 /**
@@ -92,6 +93,12 @@ export const errorHandler =
             status = 400;
             clientMessage = "Validation failed";
             details = err.issues;
+        } else if (err instanceof multer.MulterError) {
+            status = err.code === "LIMIT_FILE_SIZE" ? 413 : 400;
+            clientMessage =
+                err.code === "LIMIT_FILE_SIZE"
+                    ? "Uploaded file is too large"
+                    : "Invalid multipart upload";
         } else if (err instanceof AppError) {
             status = err.status;
             clientMessage = err.message;