@vex-chat/spire 4.1.1 → 5.0.0

package/src/__tests__/loadEnv.spec.ts

@@ -7,13 +7,11 @@
 import { describe, expect, it } from "vitest";
 
 import {
-    isSpireFipsEnabled,
     normalizeEnvValue,
     validateSpireRuntimeEnv,
 } from "../utils/loadEnv.ts";
 
 const TWEETNACL_SPK = "ab".repeat(64);
-const FIPS_SPK = "cd".repeat(90);
 const JWT_SECRET = "ef".repeat(32);
 
 describe("normalizeEnvValue", () => {
@@ -30,22 +28,11 @@ describe("normalizeEnvValue", () => {
     });
 });
 
-describe("isSpireFipsEnabled", () => {
-    it("accepts true and 1 only", () => {
-        expect(isSpireFipsEnabled("true")).toBe(true);
-        expect(isSpireFipsEnabled('"true"')).toBe(true);
-        expect(isSpireFipsEnabled("1")).toBe(true);
-        expect(isSpireFipsEnabled("false")).toBe(false);
-        expect(isSpireFipsEnabled(undefined)).toBe(false);
-    });
-});
-
 describe("validateSpireRuntimeEnv", () => {
     it("accepts quoted compose-safe tweetnacl keys", () => {
         expect(() => {
             validateSpireRuntimeEnv({
                 JWT_SECRET: `"${JWT_SECRET}"`,
-                SPIRE_FIPS: "false",
                 SPK: `"${TWEETNACL_SPK}"`,
             });
         }).not.toThrow();
@@ -60,22 +47,11 @@ describe("validateSpireRuntimeEnv", () => {
         }).toThrow(/SPK must be an even-length hex string/);
     });
 
-    it("rejects a FIPS flag with a tweetnacl-sized SPK", () => {
-        expect(() => {
-            validateSpireRuntimeEnv({
-                JWT_SECRET,
-                SPIRE_FIPS: "true",
-                SPK: TWEETNACL_SPK,
-            });
-        }).toThrow(/requires an SPK from .*gen-spk-fips/);
-    });
-
-    it("rejects a FIPS-sized SPK without the FIPS flag", () => {
+    it("rejects an SPK with the wrong length", () => {
         expect(() => {
             validateSpireRuntimeEnv({
                 JWT_SECRET,
-                SPIRE_FIPS: "false",
-                SPK: FIPS_SPK,
+                SPK: "cd".repeat(90),
             });
         }).toThrow(/SPK must be 128 hex characters/);
     });

package/src/__tests__/preKeySignature.spec.ts

@@ -5,7 +5,6 @@
  */
 
 import {
-    setCryptoProfile,
     xBoxKeyPairAsync,
     xPreKeySignaturePayload,
     xSignAsync,
@@ -13,7 +12,7 @@ import {
     XUtils,
 } from "@vex-chat/crypto";
 
-import { beforeEach, describe, expect, it } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import {
     verifyDevicePayloadPreKeySignature,
@@ -31,10 +30,6 @@ async function makeSignedPreKey() {
 }
 
 describe("prekey signature validation", () => {
-    beforeEach(() => {
-        setCryptoProfile("tweetnacl");
-    });
-
     it("accepts a prekey signed by the device signing key", async () => {
         const { preKey, signature, signKeys } = await makeSignedPreKey();
 

package/src/__tests__/spireListenPort.spec.ts

@@ -12,7 +12,7 @@ import {
 } from "../spireListenPort.ts";
 
 describe("resolveSpireListenPort", () => {
-    it("uses default for tweetnacl and fips when no explicit port", () => {
+    it("uses the default when no explicit port is provided", () => {
         expect(resolveSpireListenPort(undefined)).toBe(DEFAULT_SPIRE_API_PORT);
     });
 

package/src/run.ts

@@ -9,7 +9,7 @@ import type { SpireOptions } from "./Spire.ts";
 import { Spire } from "./Spire.ts";
 import { loadEnv } from "./utils/loadEnv.ts";
 
-async function main() {
+function main() {
     // load the environment variables — loadEnv() exits if required vars are missing
     loadEnv();
 
@@ -29,21 +29,12 @@ async function main() {
         }
     }
     const dbType = parseDbType(process.env["DB_TYPE"]);
-    const fips =
-        process.env["SPIRE_FIPS"] === "1" ||
-        process.env["SPIRE_FIPS"] === "true";
-
     const options: SpireOptions = {
         ...(apiPort !== undefined ? { apiPort } : {}),
         ...(dbType !== undefined ? { dbType } : {}),
-        ...(fips ? { cryptoProfile: "fips" } : {}),
     };
 
-    if (fips) {
-        await Spire.createAsync(spk, options);
-    } else {
-        new Spire(spk, options);
-    }
+    new Spire(spk, options);
 }
 
 function parseDbType(value: string | undefined): SpireOptions["dbType"] {
@@ -58,7 +49,9 @@ function parseDbType(value: string | undefined): SpireOptions["dbType"] {
     }
 }
 
-void main().catch((err: unknown) => {
+try {
+    main();
+} catch (err: unknown) {
     console.error(err);
     process.exit(1);
-});
+}

package/src/spireListenPort.ts

@@ -5,8 +5,7 @@
  */
 
 /**
- * Default HTTP/WS port for the Spire API (tweetnacl and FIPS), unless
- * `API_PORT` / `apiPort` is set. Clients can tell profiles apart via `GET /status`.
+ * Default HTTP/WS port for the Spire API unless `API_PORT` / `apiPort` is set.
  */
 export const DEFAULT_SPIRE_API_PORT = 16777;
 

package/src/utils/loadEnv.ts

@@ -11,7 +11,6 @@ const NORMALIZED_ENV_VARS = [
     ...REQUIRED_ENV_VARS,
     "API_PORT",
     "SPIRE_TRUST_PROXY_HOPS",
-    "SPIRE_FIPS",
     "SPIRE_PASSKEY_RP_ID",
     "SPIRE_PASSKEY_RP_NAME",
     "SPIRE_PASSKEY_ORIGINS",
@@ -22,11 +21,6 @@ const NORMALIZED_ENV_VARS = [
 const HEX_BYTES_RE = /^(?:[0-9a-fA-F]{2})+$/;
 const TWEETNACL_SPK_HEX_LENGTH = 128;
 
-export function isSpireFipsEnabled(value: string | undefined): boolean {
-    const normalized = value == null ? "" : normalizeEnvValue(value);
-    return normalized === "1" || normalized === "true";
-}
-
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv(): void {
     config();
@@ -62,25 +56,19 @@ export function validateSpireRuntimeEnv(
     const jwtSecret = normalizeEnvValue(env["JWT_SECRET"] ?? "");
     if (!HEX_BYTES_RE.test(spk)) {
         throw new Error(
-            "SPK must be an even-length hex string. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.",
+            "SPK must be an even-length hex string. Generate one with `pnpm --filter @vex-chat/spire gen-spk`.",
         );
     }
 
-    if (isSpireFipsEnabled(env["SPIRE_FIPS"])) {
-        if (spk.length === TWEETNACL_SPK_HEX_LENGTH) {
-            throw new Error(
-                "SPIRE_FIPS=true requires an SPK from `pnpm --filter @vex-chat/spire gen-spk-fips`; the configured SPK looks like a tweetnacl key.",
-            );
-        }
-    } else if (spk.length !== TWEETNACL_SPK_HEX_LENGTH) {
+    if (spk.length !== TWEETNACL_SPK_HEX_LENGTH) {
         throw new Error(
-            "SPIRE_FIPS is not enabled, so SPK must be 128 hex characters from `pnpm --filter @vex-chat/spire gen-spk`.",
+            "SPK must be 128 hex characters from `pnpm --filter @vex-chat/spire gen-spk`.",
         );
     }
 
     if (jwtSecret.length === 0) {
         throw new Error(
-            "JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.",
+            "JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk`.",
         );
     }
     if (jwtSecret.length < 32) {

package/src/utils/spireXSignOpenAsync.ts

@@ -4,17 +4,12 @@
  * Commercial licenses available at vex.wtf
  */
 
-import { getCryptoProfile, xSignOpen, xSignOpenAsync } from "@vex-chat/crypto";
+import { xSignOpen } from "@vex-chat/crypto";
 
-/**
- * Ed25519 detached-verify open: sync on tweetnacl, async for FIPS (Web Crypto).
- */
-export async function spireXSignOpenAsync(
+/** Ed25519 detached-verify open. */
+export function spireXSignOpenAsync(
     signedMessage: Uint8Array,
     publicKey: Uint8Array,
 ): Promise<null | Uint8Array> {
-    if (getCryptoProfile() === "fips") {
-        return xSignOpenAsync(signedMessage, publicKey);
-    }
-    return xSignOpen(signedMessage, publicKey);
+    return Promise.resolve(xSignOpen(signedMessage, publicKey));
 }