@vex-chat/spire 4.0.0 → 4.1.0

package/src/__tests__/serverManagement.spec.ts

@@ -0,0 +1,262 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type {
+    Channel,
+    Permission,
+    User,
+    Server as VexServer,
+} from "@vex-chat/types";
+import type { Server } from "node:http";
+
+import express from "express";
+
+import { xSignKeyPair, XUtils } from "@vex-chat/crypto";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import { initApp } from "../server/index.ts";
+import { signAuthJwt } from "../utils/authJwt.ts";
+import { msgpack } from "../utils/msgpack.ts";
+
+const testImage = XUtils.decodeBase64(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQABNjN9GQAAAABJRU5ErkJggg==",
+);
+
+const originalJwtSecret = process.env["JWT_SECRET"];
+const user: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "8d768e5c-55ec-4fe4-bcb2-26bdde8076d9",
+    username: "server-admin",
+};
+const member: User = {
+    lastSeen: new Date(0).toISOString(),
+    userID: "3e1225e2-88bb-469f-bef3-28531da7f97a",
+    username: "group-member",
+};
+
+describe("server management routes", () => {
+    afterEach(() => {
+        if (originalJwtSecret === undefined) {
+            delete process.env["JWT_SECRET"];
+        } else {
+            process.env["JWT_SECRET"] = originalJwtSecret;
+        }
+    });
+
+    it("renames servers and channels, manages icons, and preserves one channel", async () => {
+        process.env["JWT_SECRET"] = "server-management-test-secret";
+        const db = new Database({ dbType: "sqlite3mem" });
+        await ready(db);
+        await db["db"]
+            .insertInto("users")
+            .values(
+                [user, member].map((entry) => ({
+                    ...entry,
+                    passwordHash: "not-used-by-this-test",
+                })),
+            )
+            .execute();
+        const created = await db.createServer("Before", user.userID);
+        const memberPermission = await db.createPermission(
+            member.userID,
+            "server",
+            created.serverID,
+            0,
+        );
+        const ownerPermission = (
+            await db.retrievePermissionsByResourceID(created.serverID)
+        ).find((permission) => permission.userID === user.userID);
+        expect(ownerPermission).toBeDefined();
+        const notify = vi.fn();
+        const app = express();
+        initApp(app, db, () => false, xSignKeyPair(), notify);
+        const listener = await listen(app);
+
+        try {
+            const origin = serverOrigin(listener);
+            const headers = {
+                Authorization: `Bearer ${signAuthJwt({ scope: "user", user }, "5m")}`,
+                "Content-Type": "application/msgpack",
+            };
+
+            const createServer = await fetch(`${origin}/servers`, {
+                body: msgpack.encode({ name: "Café 作戦" }),
+                headers,
+                method: "POST",
+            });
+            expect(createServer.status).toBe(200);
+            expect(await decode<VexServer>(createServer)).toMatchObject({
+                name: "Café 作戦",
+            });
+
+            const renameServer = await fetch(
+                `${origin}/server/${created.serverID}`,
+                {
+                    body: msgpack.encode({ name: "After" }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(renameServer.status).toBe(200);
+            expect(await decode<VexServer>(renameServer)).toMatchObject({
+                name: "After",
+                serverID: created.serverID,
+            });
+
+            const promoteMember = await fetch(
+                `${origin}/permission/${memberPermission.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 50 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(promoteMember.status).toBe(200);
+            expect(await decode<Permission>(promoteMember)).toMatchObject({
+                permissionID: memberPermission.permissionID,
+                powerLevel: 50,
+            });
+
+            const memberHeaders = {
+                Authorization: `Bearer ${signAuthJwt({ scope: "user", user: member }, "5m")}`,
+                "Content-Type": "application/msgpack",
+            };
+            const moderatorCannotChangeRoles = await fetch(
+                `${origin}/permission/${ownerPermission!.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 100 }),
+                    headers: memberHeaders,
+                    method: "PATCH",
+                },
+            );
+            expect(moderatorCannotChangeRoles.status).toBe(403);
+
+            const ownerCannotChangeOwnRole = await fetch(
+                `${origin}/permission/${ownerPermission!.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 50 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(ownerCannotChangeOwnRole.status).toBe(400);
+
+            const unsupportedRole = await fetch(
+                `${origin}/permission/${memberPermission.permissionID}`,
+                {
+                    body: msgpack.encode({ powerLevel: 25 }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(unsupportedRole.status).toBe(400);
+
+            const [general] = await db.retrieveChannels(created.serverID);
+            expect(general).toBeDefined();
+            const renameChannel = await fetch(
+                `${origin}/channel/${general!.channelID}`,
+                {
+                    body: msgpack.encode({ name: "announcements" }),
+                    headers,
+                    method: "PATCH",
+                },
+            );
+            expect(renameChannel.status).toBe(200);
+            expect(await decode<Channel>(renameChannel)).toMatchObject({
+                name: "announcements",
+            });
+
+            const lastChannel = await fetch(
+                `${origin}/channel/${general!.channelID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(lastChannel.status).toBe(409);
+
+            const extra = await db.createChannel("extra", created.serverID);
+            const deleteExtra = await fetch(
+                `${origin}/channel/${extra.channelID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(deleteExtra.status).toBe(200);
+
+            const setIcon = await fetch(
+                `${origin}/server-icon/${created.serverID}/json`,
+                {
+                    body: msgpack.encode({
+                        file: XUtils.encodeBase64(testImage),
+                    }),
+                    headers,
+                    method: "POST",
+                },
+            );
+            expect(setIcon.status).toBe(200);
+            const withIcon = await decode<VexServer>(setIcon);
+            expect(withIcon.icon).toEqual(expect.any(String));
+
+            const iconResponse = await fetch(
+                `${origin}/server-icon/${withIcon.icon!}`,
+            );
+            expect(iconResponse.status).toBe(200);
+            expect(iconResponse.headers.get("cache-control")).toContain(
+                "immutable",
+            );
+
+            const removeIcon = await fetch(
+                `${origin}/server-icon/${created.serverID}`,
+                { headers, method: "DELETE" },
+            );
+            expect(removeIcon.status).toBe(200);
+            expect((await decode<VexServer>(removeIcon)).icon).toBeUndefined();
+            expect(notify).toHaveBeenCalledWith(
+                user.userID,
+                "serverChange",
+                expect.any(String),
+                created.serverID,
+            );
+        } finally {
+            await close(listener);
+            await db.close();
+        }
+    });
+});
+
+async function close(server: Server): Promise<void> {
+    await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+            if (error) reject(error);
+            else resolve();
+        });
+    });
+}
+
+async function decode<T>(response: Response): Promise<T> {
+    return msgpack.decode(new Uint8Array(await response.arrayBuffer())) as T;
+}
+
+async function listen(app: express.Application): Promise<Server> {
+    return new Promise((resolve) => {
+        const server = app.listen(0, "127.0.0.1", () => {
+            resolve(server);
+        });
+    });
+}
+
+async function ready(db: Database): Promise<void> {
+    await new Promise<void>((resolve, reject) => {
+        db.once("ready", resolve);
+        db.once("error", reject);
+    });
+}
+
+function serverOrigin(server: Server): string {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Expected TCP listener.");
+    }
+    return `http://127.0.0.1:${String(address.port)}`;
+}

package/src/server/avatar.ts

@@ -54,6 +54,7 @@ export const getAvatarRouter = () => {
         }
         res.set("Content-type", typeDetails.mime);
         res.set("Cache-control", "public, max-age=31536000");
+        res.set("Cross-Origin-Resource-Policy", "cross-origin");
 
         const stream = fs.createReadStream(filePath);
         stream.on("error", (_err) => {
@@ -100,7 +101,7 @@ export const getAvatarRouter = () => {
         if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
             res.status(400).send({
                 error:
-                    "Unsupported file type. Expected jpeg, png, gif, apng, avif, or svg but received " +
+                    "Unsupported file type. Expected jpeg, png, gif, apng, avif, or webp but received " +
                     String(mimeType?.ext),
             });
             return;
@@ -143,7 +144,7 @@ export const getAvatarRouter = () => {
             if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
                 res.status(400).send({
                     error:
-                        "Unsupported file type. Expected jpeg, png, gif, apng, avif, or svg but received " +
+                        "Unsupported file type. Expected jpeg, png, gif, apng, avif, or webp but received " +
                         String(mimeType?.ext),
                 });
                 return;

package/src/server/cliPasskeyPage.ts

@@ -150,6 +150,13 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
         "use strict";
 
         var params = new URLSearchParams(window.location.hash.slice(1));
+        if (window.location.hash) {
+            window.history.replaceState(
+                null,
+                "",
+                window.location.pathname + window.location.search,
+            );
+        }
         var action = document.getElementById("action");
         var statusEl = document.getElementById("status");
         var titleEl = document.getElementById("title");
@@ -158,6 +165,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
         var startupError = null;
         var apiBase = window.location.origin;
         var busy = false;
+        var completed = false;
 
         try {
             apiBase = resolveTrustedApiBase(params.get("api"));
@@ -165,11 +173,16 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             startupError = err;
         }
 
-        if (mode === "register") {
+        if (mode === "register" || mode === "register-handoff") {
             titleEl.textContent = "Create a passkey for Vex.";
             copyEl.textContent = "This adds a passkey to your Vex account.";
             action.textContent = "Create passkey";
             setStatus("Ready to create passkey.");
+        } else if (mode === "authenticate-handoff") {
+            titleEl.textContent = "Continue signing in to Vex.";
+            copyEl.textContent =
+                "Use your passkey here, then return to the Vex desktop app.";
+            setStatus("Ready to verify passkey.");
         } else {
             setStatus("Ready to verify passkey.");
         }
@@ -190,7 +203,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
 
         function setBusy(nextBusy) {
             busy = nextBusy;
-            action.disabled = nextBusy;
+            action.disabled = nextBusy || completed;
         }
 
         function apiUrl(path) {
@@ -271,12 +284,19 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
                 }
                 if (mode === "register") {
                     await registerPasskey();
+                } else if (mode === "register-handoff") {
+                    await registerPasskeyWithHandoff();
+                } else if (mode === "authenticate-handoff") {
+                    await authenticatePasskeyWithHandoff();
                 } else {
                     await recoverWithPasskey();
                 }
             } catch (err) {
                 setStatus(errorMessage(err), "error");
-                action.textContent = mode === "register" ? "Try again" : "Retry passkey";
+                action.textContent =
+                    mode === "register" || mode === "register-handoff"
+                        ? "Try again"
+                        : "Retry passkey";
             } finally {
                 setBusy(false);
             }
@@ -297,15 +317,8 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
                 body: { name: name },
                 token: token,
             });
-            var credentialOptions = makeCreationOptions(begin.options);
-
             setStatus("Waiting for browser passkey prompt...");
-            var credential = await navigator.credentials.create({
-                publicKey: credentialOptions,
-            });
-            if (!credential) {
-                throw new Error("No passkey was created.");
-            }
+            var credential = await createPasskeyCredential(begin.options);
 
             setStatus("Saving passkey...");
             await apiRequest("/user/" + encodeURIComponent(userID) + "/passkeys/register/finish", {
@@ -319,6 +332,90 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             setStatus("Passkey saved. Return to the Vex CLI.", "success");
             titleEl.textContent = "Passkey saved.";
             copyEl.textContent = "The CLI can finish connecting now.";
+            completed = true;
+            action.textContent = "Done";
+        }
+
+        async function registerPasskeyWithHandoff() {
+            var token = requiredParam("token");
+            var requestID = requiredParam("request");
+
+            setStatus("Requesting a one-time passkey challenge...");
+            var begin = await apiRequest(
+                "/auth/passkey/browser-registration/" +
+                    encodeURIComponent(requestID) +
+                    "/begin",
+                { body: { token: token } },
+            );
+
+            setStatus("Waiting for browser passkey prompt...");
+            var credential = await createPasskeyCredential(begin.options);
+
+            setStatus("Saving passkey...");
+            await apiRequest(
+                "/auth/passkey/browser-registration/" +
+                    encodeURIComponent(requestID) +
+                    "/finish",
+                {
+                    body: {
+                        response: registrationResponseJSON(credential),
+                        token: token,
+                    },
+                },
+            );
+            setStatus("Passkey saved. You can close this page.", "success");
+            titleEl.textContent = "Passkey saved.";
+            copyEl.textContent = "Vex has updated your account.";
+            completed = true;
+            action.textContent = "Done";
+        }
+
+        async function createPasskeyCredential(options) {
+            var credential = await navigator.credentials.create({
+                publicKey: makeCreationOptions(options),
+            });
+            if (!credential) {
+                throw new Error("No passkey was created.");
+            }
+            return credential;
+        }
+
+        async function authenticatePasskeyWithHandoff() {
+            var token = requiredParam("token");
+            var requestID = requiredParam("request");
+
+            setStatus("Requesting a one-time passkey challenge...");
+            var begin = await apiRequest(
+                "/auth/passkey/browser-authentication/" +
+                    encodeURIComponent(requestID) +
+                    "/begin",
+                { body: { token: token } },
+            );
+
+            setStatus("Waiting for browser passkey prompt...");
+            var credential = await navigator.credentials.get({
+                publicKey: makeRequestOptions(begin.options),
+            });
+            if (!credential) {
+                throw new Error("No passkey was returned.");
+            }
+
+            setStatus("Returning verification to Vex...");
+            await apiRequest(
+                "/auth/passkey/browser-authentication/" +
+                    encodeURIComponent(requestID) +
+                    "/finish",
+                {
+                    body: {
+                        response: authenticationResponseJSON(credential),
+                        token: token,
+                    },
+                },
+            );
+            setStatus("Passkey verified. You can close this page.", "success");
+            titleEl.textContent = "Passkey verified.";
+            copyEl.textContent = "Return to Vex to finish signing in.";
+            completed = true;
             action.textContent = "Done";
         }
 
@@ -371,6 +468,7 @@ const CLI_PASSKEY_PAGE = `<!doctype html>
             setStatus("CLI device recovered. Return to the Vex CLI.", "success");
             titleEl.textContent = "Device signed in.";
             copyEl.textContent = "The CLI can finish connecting now.";
+            completed = true;
             action.textContent = "Done";
         }