@vex-chat/spire 3.0.1 → 4.1.0

package/src/server/passkeyDevices.ts

@@ -86,6 +86,7 @@ export const getPasskeyDeviceRouter = (
             // "I lost my phone, sign in with the passkey, wipe the
             // old device, then recover onto a new one."
             await db.deleteDevice(deviceID);
+            disconnectDevices?.([deviceID]);
             // Tell whoever's online that the device-list shape
             // changed; clients use this to refresh the Settings →
             // Devices view in real time.

package/src/server/password.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+
+import express from "express";
+
+import { PasswordUpdatePayloadSchema } from "@vex-chat/types";
+
+import {
+    hashPasswordArgon2,
+    validateAccountPassword,
+    verifyPassword,
+} from "../Database.ts";
+
+import { AppError } from "./errors.ts";
+import { passwordUpdateLimiter } from "./rateLimit.ts";
+import { getParam, getUser } from "./utils.ts";
+
+import { protectAnyAuth } from "./index.ts";
+
+export const getPasswordRouter = (db: Database) => {
+    const router = express.Router();
+
+    router.patch(
+        "/user/:id/password",
+        protectAnyAuth,
+        passwordUpdateLimiter,
+        async (req, res) => {
+            const authenticatedUser = getUser(req);
+            const userID = getParam(req, "id");
+            if (authenticatedUser.userID !== userID) {
+                throw new AppError(403, "Not authorized for this account");
+            }
+
+            const payload = PasswordUpdatePayloadSchema.parse(req.body);
+            const user = await db.retrieveUser(userID);
+            if (!user) {
+                throw new AppError(404, "Account not found");
+            }
+
+            const passwordError = validateAccountPassword(
+                payload.newPassword,
+                user.username,
+            );
+            if (passwordError) {
+                throw new AppError(400, passwordError);
+            }
+
+            if (req.passkey) {
+                const passkey = await db.retrievePasskeyInternal(
+                    req.passkey.passkeyID,
+                );
+                if (!passkey || passkey.userID !== userID) {
+                    throw new AppError(401, "Passkey authentication required");
+                }
+            } else {
+                if (
+                    !req.device ||
+                    req.device.owner !== userID ||
+                    !payload.currentPassword
+                ) {
+                    throw new AppError(
+                        401,
+                        "Current-password authentication required",
+                    );
+                }
+                const current = await verifyPassword(
+                    payload.currentPassword,
+                    user,
+                );
+                if (!current.valid) {
+                    throw new AppError(401, "Current password is incorrect");
+                }
+            }
+
+            const reused = await verifyPassword(payload.newPassword, user);
+            if (reused.valid) {
+                throw new AppError(
+                    409,
+                    "New password must be different from the current password",
+                );
+            }
+
+            const passwordHash = await hashPasswordArgon2(payload.newPassword);
+            await db.rehashPassword(userID, passwordHash);
+            res.setHeader("Cache-Control", "no-store");
+            res.sendStatus(204);
+        },
+    );
+
+    return router;
+};

package/src/server/permissions.ts

@@ -6,6 +6,24 @@
 
 import type { Permission } from "@vex-chat/types";
 
+export function canDeletePermission(
+    permissions: Permission[],
+    actorUserID: string,
+    target: Permission,
+    adminPowerLevel: number,
+): boolean {
+    if (target.userID === actorUserID) {
+        return true;
+    }
+    return permissions.some(
+        (permission) =>
+            permission.userID === actorUserID &&
+            permission.resourceID === target.resourceID &&
+            permission.powerLevel >= adminPowerLevel &&
+            permission.powerLevel > target.powerLevel,
+    );
+}
+
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).
@@ -27,7 +45,7 @@ export function hasPermission(
     minPowerLevel: number,
 ): boolean {
     return permissions.some(
-        (p) => p.resourceID === resourceID && p.powerLevel > minPowerLevel,
+        (p) => p.resourceID === resourceID && p.powerLevel >= minPowerLevel,
     );
 }
 
@@ -41,6 +59,6 @@ export function userHasPermission(
     minPowerLevel: number,
 ): boolean {
     return permissions.some(
-        (p) => p.userID === userID && p.powerLevel > minPowerLevel,
+        (p) => p.userID === userID && p.powerLevel >= minPowerLevel,
     );
 }

package/src/server/rateLimit.ts

@@ -74,15 +74,14 @@ function disableRateLimitsByEnv(): boolean {
  * versions silently collapsed all IPv4-mapped IPv6 addresses into
  * one bucket, which let attackers bypass the limiter).
  *
- * `trust proxy` must be set on the Express app (see Spire.ts) so
- * `req.ip` returns the real client address, not the immediate proxy.
+ * `trust proxy` must match the real deployment topology (see Spire.ts) so
+ * `req.ip` cannot be spoofed and does not collapse all traffic onto a proxy.
  */
 
 /**
  * Bucket requests by the real client IP, IPv6-safe.
  *
- * `req.ip` is already populated correctly because `trust proxy` is
- * set to `1` in Spire's constructor. We still run it through
+ * `req.ip` reflects the explicitly configured proxy hop count. We still run it through
  * `ipKeyGenerator` so IPv4-mapped IPv6 (`::ffff:1.2.3.4`) doesn't
  * collide with unrelated IPv6 addresses in the same /56.
  */
@@ -123,6 +122,50 @@ export const authLimiter = rateLimit({
     windowMs: 15 * 60 * 1000,
 });
 
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export const accountAuthLimiter = rateLimit({
+    keyGenerator: (req) => {
+        const body: unknown = req.body;
+        const username =
+            typeof body === "object" &&
+            body !== null &&
+            "username" in body &&
+            typeof body.username === "string"
+                ? body.username.trim().toLowerCase().slice(0, 64)
+                : "";
+        return username.length > 0
+            ? `account:${username}`
+            : `invalid:${keyByIp(req)}`;
+    },
+    legacyHeaders: false,
+    limit: 100,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export const passwordUpdateLimiter = rateLimit({
+    keyGenerator: (req) =>
+        req.user?.userID
+            ? `password:${req.user.userID}`
+            : `invalid:${keyByIp(req)}`,
+    legacyHeaders: false,
+    limit: 10,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/src/server/serverIcon.ts

@@ -0,0 +1,199 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Database } from "../Database.ts";
+import type { Server } from "@vex-chat/types";
+
+import * as fs from "node:fs";
+import * as fsp from "node:fs/promises";
+
+import express from "express";
+
+import { XUtils } from "@vex-chat/crypto";
+
+import { fileTypeFromBuffer, fileTypeFromFile } from "file-type";
+import multer from "multer";
+import { z } from "zod/v4";
+
+import { POWER_LEVELS } from "../ClientManager.ts";
+import { msgpack } from "../utils/msgpack.ts";
+
+import { hasPermission } from "./permissions.ts";
+import { uploadLimiter } from "./rateLimit.ts";
+import { getParam, getUser } from "./utils.ts";
+
+import { ALLOWED_IMAGE_TYPES, protect } from "./index.ts";
+
+const SERVER_ICON_DIR = "server-icons";
+const MAX_SERVER_ICON_BYTES = 5 * 1024 * 1024;
+const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+const serverIconUpload = multer({
+    limits: { fields: 1, files: 1, fileSize: MAX_SERVER_ICON_BYTES, parts: 2 },
+});
+const serverIconJsonPayload = z.object({
+    file: z
+        .string()
+        .min(1)
+        .max(Math.ceil((MAX_SERVER_ICON_BYTES * 4) / 3) + 4),
+});
+
+type NotifyServerChange = (serverID: string) => Promise<void>;
+
+export async function deleteServerIconFile(iconID: string): Promise<void> {
+    const safeID = safePathParam.safeParse(iconID);
+    if (!safeID.success) return;
+    await fsp
+        .unlink(`${SERVER_ICON_DIR}/${safeID.data}`)
+        .catch(() => undefined);
+}
+
+export const getServerIconRouter = (
+    db: Database,
+    notifyServerChange: NotifyServerChange,
+) => {
+    const router = express.Router();
+
+    router.get("/:iconID", async (req, res) => {
+        const safeID = safePathParam.safeParse(getParam(req, "iconID"));
+        if (!safeID.success) {
+            res.sendStatus(400);
+            return;
+        }
+
+        const filePath = `${SERVER_ICON_DIR}/${safeID.data}`;
+        const typeDetails = await fileTypeFromFile(filePath).catch(() => null);
+        if (!typeDetails) {
+            res.sendStatus(404);
+            return;
+        }
+
+        res.set("Content-Type", typeDetails.mime);
+        res.set("Cache-Control", "public, max-age=31536000, immutable");
+        res.set("Cross-Origin-Resource-Policy", "cross-origin");
+        const stream = fs.createReadStream(filePath);
+        stream.on("error", () => {
+            if (!res.headersSent) res.sendStatus(500);
+            else res.destroy();
+        });
+        stream.pipe(res);
+    });
+
+    router.post("/:serverID/json", uploadLimiter, protect, async (req, res) => {
+        const parsed = serverIconJsonPayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server icon payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+
+        let buffer: Buffer;
+        try {
+            buffer = Buffer.from(XUtils.decodeBase64(parsed.data.file));
+        } catch {
+            res.status(400).json({ error: "Icon must be valid base64." });
+            return;
+        }
+        await saveIcon(req, res, db, notifyServerChange, buffer);
+    });
+
+    router.post(
+        "/:serverID",
+        uploadLimiter,
+        protect,
+        serverIconUpload.single("icon"),
+        async (req, res) => {
+            if (!req.file) {
+                res.sendStatus(400);
+                return;
+            }
+            await saveIcon(req, res, db, notifyServerChange, req.file.buffer);
+        },
+    );
+
+    router.delete("/:serverID", protect, async (req, res) => {
+        const serverID = getParam(req, "serverID");
+        if (!(await canManageServer(db, getUser(req).userID, serverID))) {
+            res.sendStatus(403);
+            return;
+        }
+
+        const existing = await db.retrieveServer(serverID);
+        if (!existing) {
+            res.sendStatus(404);
+            return;
+        }
+        const updated = await db.updateServer(serverID, { icon: null });
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+
+        if (existing.icon) await deleteServerIconFile(existing.icon);
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(updated));
+    });
+
+    return router;
+};
+
+async function canManageServer(
+    db: Database,
+    userID: string,
+    serverID: string,
+): Promise<boolean> {
+    const permissions = await db.retrievePermissions(userID, "server");
+    return hasPermission(permissions, serverID, POWER_LEVELS.CREATE);
+}
+
+async function saveIcon(
+    req: express.Request,
+    res: express.Response,
+    db: Database,
+    notifyServerChange: NotifyServerChange,
+    buffer: Buffer,
+): Promise<void> {
+    const serverID = getParam(req, "serverID");
+    if (!(await canManageServer(db, getUser(req).userID, serverID))) {
+        res.sendStatus(403);
+        return;
+    }
+    if (buffer.byteLength > MAX_SERVER_ICON_BYTES) {
+        res.sendStatus(413);
+        return;
+    }
+
+    const typeDetails = await fileTypeFromBuffer(buffer);
+    if (!ALLOWED_IMAGE_TYPES.includes(typeDetails?.mime ?? "")) {
+        res.status(400).json({
+            error: "Unsupported icon type. Use JPEG, PNG, GIF, APNG, AVIF, or WebP.",
+        });
+        return;
+    }
+
+    const existing = await db.retrieveServer(serverID);
+    if (!existing) {
+        res.sendStatus(404);
+        return;
+    }
+
+    const iconID = crypto.randomUUID();
+    const filePath = `${SERVER_ICON_DIR}/${iconID}`;
+    try {
+        await fsp.writeFile(filePath, buffer, { flag: "wx" });
+        const updated = await db.updateServer(serverID, { icon: iconID });
+        if (!updated) {
+            throw new Error("Server disappeared while its icon was updating.");
+        }
+        if (existing.icon) await deleteServerIconFile(existing.icon);
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(updated satisfies Server));
+    } catch (error: unknown) {
+        await fsp.unlink(filePath).catch(() => undefined);
+        throw error;
+    }
+}

package/src/server/user.ts

@@ -24,7 +24,9 @@ import {
 import { stringify } from "uuid";
 import { z } from "zod/v4";
 
+import { MAX_ACTIVE_DEVICES_PER_USER } from "../Database.ts";
 import { msgpack } from "../utils/msgpack.ts";
+import { verifyDevicePayloadPreKeySignature } from "../utils/preKeySignature.ts";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.ts";
 
 import { AppError } from "./errors.ts";
@@ -491,6 +493,7 @@ export const getUserRouter = (
         data?: unknown,
         deviceID?: string,
     ) => void,
+    disconnectDevices?: (deviceIDs: string[]) => void,
 ) => {
     const router = express.Router();
 
@@ -581,7 +584,7 @@ export const getUserRouter = (
                 authenticatorSelection: {
                     requireResidentKey: false,
                     residentKey: "preferred",
-                    userVerification: "preferred",
+                    userVerification: "required",
                 },
                 excludeCredentials: [],
                 rpID,
@@ -675,16 +678,20 @@ export const getUserRouter = (
                     expectedChallenge: passkeyRegistration.challenge,
                     expectedOrigin,
                     expectedRPID: rpID,
-                    requireUserVerification: false,
+                    requireUserVerification: true,
                     // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
                     response: parsed.data
                         .response as unknown as RegistrationResponseJSON,
                 });
             } catch (err: unknown) {
+                const requestId = crypto.randomUUID();
                 const message =
                     err instanceof Error ? err.message : String(err);
+                console.warn(
+                    `[spire] pending-device WebAuthn registration failed requestId=${requestId} message=${message}`,
+                );
                 res.status(400).send({
-                    error: "Passkey attestation invalid: " + message,
+                    error: "Passkey attestation could not be verified.",
                 });
                 return;
             }
@@ -811,6 +818,10 @@ export const getUserRouter = (
 
     router.get("/:id/permissions", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const permissions = await db.retrievePermissions(
             userDetails.userID,
             "all",
@@ -820,12 +831,20 @@ export const getUserRouter = (
 
     router.get("/:id/servers", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const servers = await db.retrieveServers(userDetails.userID);
         res.send(msgpack.encode(servers));
     });
 
     router.get("/:id/servers/bootstrap", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const payload = await db.retrieveServerChannelBootstrap(
             userDetails.userID,
         );
@@ -840,8 +859,14 @@ export const getUserRouter = (
             return;
         }
         const userDetails = getUser(req);
-        if (userDetails.userID !== device.owner) {
-            res.sendStatus(401);
+        const currentDevice = req.device;
+        if (
+            getParam(req, "userID") !== userDetails.userID ||
+            userDetails.userID !== device.owner ||
+            !currentDevice ||
+            currentDevice.owner !== userDetails.userID
+        ) {
+            res.sendStatus(403);
             return;
         }
         const deviceList = await db.retrieveUserDeviceList([
@@ -855,6 +880,7 @@ export const getUserRouter = (
         }
 
         await db.deleteDevice(device.deviceID);
+        disconnectDevices?.([device.deviceID]);
         res.sendStatus(200);
     });
 
@@ -893,9 +919,21 @@ export const getUserRouter = (
         }
 
         if (tokenValidator(stringify(token), TokenScopes.Device)) {
+            if (!(await verifyDevicePayloadPreKeySignature(deviceData))) {
+                res.status(400).send({
+                    error: "Signed prekey signature is invalid.",
+                });
+                return;
+            }
             const userDevices = await db.retrieveUserDeviceList([
                 userDetails.userID,
             ]);
+            if (userDevices.length >= MAX_ACTIVE_DEVICES_PER_USER) {
+                res.status(409).send({
+                    error: `Each account is limited to ${String(MAX_ACTIVE_DEVICES_PER_USER)} active devices. Remove an old device before adding another.`,
+                });
+                return;
+            }
             if (userDevices.length === 0) {
                 try {
                     const device = await db.createDevice(
@@ -1026,10 +1064,7 @@ export const getUserRouter = (
                 return;
             }
 
-            // New clients put the passkey proof on the requesting device.
-            // Older clients may still satisfy this with an approval-side passkey.
-            const approvedByPasskeyID =
-                pending.requesterPasskeyID ?? req.passkey?.passkeyID;
+            const approvedByPasskeyID = pending.requesterPasskeyID;
             if (approvedByPasskeyID) {
                 const passkey =
                     await db.retrievePasskeyInternal(approvedByPasskeyID);

package/src/types/express.ts

@@ -22,10 +22,9 @@ declare global {
             device?: Device;
             exp?: number;
             /**
-             * Set by `checkPasskey` middleware when the bearer token is
-             * a passkey-scoped JWT. The presence of `req.passkey`
-             * (without `req.device`) marks an admin-only request that
-             * may list/delete devices and recover/reject enrollments, but
+             * Set for a revalidated passkey-scoped JWT. The presence of
+             * `req.passkey` (without `req.device`) marks an admin-only request
+             * that may list/delete devices and recover/reject enrollments, but
              * cannot send mail or do anything device-specific.
              */
             passkey?: { passkeyID: string };

package/src/utils/authJwt.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { JwtPayload, SignOptions } from "jsonwebtoken";
+
+import jwt from "jsonwebtoken";
+
+import { getJwtSecret } from "./jwtSecret.ts";
+
+const JWT_AUDIENCE = "vex-client";
+const JWT_ISSUER = "vex-spire";
+
+export function signAuthJwt(
+    payload: Record<string, unknown>,
+    expiresIn: NonNullable<SignOptions["expiresIn"]>,
+): string {
+    return jwt.sign(payload, getJwtSecret(), {
+        algorithm: "HS256",
+        audience: JWT_AUDIENCE,
+        expiresIn,
+        issuer: JWT_ISSUER,
+    });
+}
+
+export function verifyAuthJwt(token: string): JwtPayload | string {
+    return jwt.verify(token, getJwtSecret(), {
+        algorithms: ["HS256"],
+        audience: JWT_AUDIENCE,
+        issuer: JWT_ISSUER,
+    });
+}

package/src/utils/loadEnv.ts

@@ -10,6 +10,7 @@ const REQUIRED_ENV_VARS = ["DB_TYPE", "JWT_SECRET", "SPK"] as const;
 const NORMALIZED_ENV_VARS = [
     ...REQUIRED_ENV_VARS,
     "API_PORT",
+    "SPIRE_TRUST_PROXY_HOPS",
     "SPIRE_FIPS",
     "SPIRE_PASSKEY_RP_ID",
     "SPIRE_PASSKEY_RP_NAME",
@@ -82,6 +83,9 @@ export function validateSpireRuntimeEnv(
             "JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.",
         );
     }
+    if (jwtSecret.length < 32) {
+        throw new Error("JWT_SECRET must contain at least 32 characters.");
+    }
     if (jwtSecret === spk) {
         throw new Error("JWT_SECRET must be separate from SPK.");
     }

package/src/utils/preKeySignature.ts

@@ -6,13 +6,7 @@
 
 import type { DevicePayload, PreKeysWS } from "@vex-chat/types";
 
-import {
-    getCryptoProfile,
-    xConcat,
-    xConstants,
-    xEncode,
-    XUtils,
-} from "@vex-chat/crypto";
+import { xPreKeySignaturePayload, XUtils } from "@vex-chat/crypto";
 
 import { spireXSignOpenAsync } from "./spireXSignOpenAsync.ts";
 
@@ -24,6 +18,7 @@ export async function verifyDevicePayloadPreKeySignature(
             XUtils.decodeHex(payload.preKey),
             XUtils.decodeHex(payload.preKeySignature),
             payload.signKey,
+            "signed",
         );
     } catch {
         return false;
@@ -33,20 +28,21 @@ export async function verifyDevicePayloadPreKeySignature(
 export async function verifyPreKeyWsSignature(
     preKey: PreKeysWS,
     signKeyHex: string,
+    kind: "one-time" | "signed",
 ): Promise<boolean> {
-    return verifySignedPreKey(preKey.publicKey, preKey.signature, signKeyHex);
-}
-
-function preKeySignPayload(publicKey: Uint8Array): Uint8Array {
-    return getCryptoProfile() === "fips"
-        ? xConcat(new Uint8Array([0xa1]), publicKey)
-        : xEncode(xConstants.CURVE, publicKey);
+    return verifySignedPreKey(
+        preKey.publicKey,
+        preKey.signature,
+        signKeyHex,
+        kind,
+    );
 }
 
 async function verifySignedPreKey(
     publicKey: Uint8Array,
     signature: Uint8Array,
     signKeyHex: string,
+    kind: "one-time" | "signed",
 ): Promise<boolean> {
     try {
         const opened = await spireXSignOpenAsync(
@@ -54,7 +50,8 @@ async function verifySignedPreKey(
             XUtils.decodeHex(signKeyHex),
         );
         return Boolean(
-            opened && XUtils.bytesEqual(opened, preKeySignPayload(publicKey)),
+            opened &&
+            XUtils.bytesEqual(opened, xPreKeySignaturePayload(publicKey, kind)),
         );
     } catch {
         return false;