ciphermesh 1.0.0

package/src/protocol/validators.js

@@ -0,0 +1,175 @@
+import {
+  PROTOCOL_VERSION,
+  MAX_NICKNAME_LENGTH,
+  MAX_PAYLOAD_SIZE,
+  PUBLIC_KEY_SIZE,
+} from '../shared/constants.js';
+
+// ── Helpers ────────────────────────────────────────────────────
+function isString(v) {
+  return typeof v === 'string';
+}
+
+function isNumber(v) {
+  return typeof v === 'number' && Number.isFinite(v);
+}
+
+function isObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+function isValidBase64(str, expectedBytes) {
+  if (!isString(str)) {
+    return false;
+  }
+  try {
+    const buf = Buffer.from(str, 'base64');
+    return expectedBytes ? buf.length === expectedBytes : buf.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+function sanitizeNickname(nick) {
+  if (!isString(nick)) {
+    return null;
+  }
+  // eslint-disable-next-line no-control-regex
+  const clean = nick.replace(/[\x00-\x1f\x7f]/g, '').trim();
+  if (clean.length === 0 || clean.length > MAX_NICKNAME_LENGTH) {
+    return null;
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(clean)) {
+    return null;
+  }
+  return clean;
+}
+
+// ── Parse + validate incoming JSON ─────────────────────────────
+export function parseMessage(raw) {
+  if (typeof raw === 'string' && raw.length > MAX_PAYLOAD_SIZE) {
+    return { valid: false, error: 'Payload too large' };
+  }
+
+  let msg;
+  try {
+    msg = typeof raw === 'string' ? JSON.parse(raw) : raw;
+  } catch {
+    return { valid: false, error: 'Invalid JSON' };
+  }
+
+  if (!isObject(msg)) {
+    return { valid: false, error: 'Message must be an object' };
+  }
+  if (msg.version !== PROTOCOL_VERSION) {
+    return { valid: false, error: `Unsupported protocol version: ${msg.version}` };
+  }
+  if (!isString(msg.type)) {
+    return { valid: false, error: 'Missing message type' };
+  }
+  if (!isNumber(msg.timestamp)) {
+    return { valid: false, error: 'Missing timestamp' };
+  }
+
+  return { valid: true, msg };
+}
+
+// ── Type-specific validators ───────────────────────────────────
+export function validateJoin(msg) {
+  const nick = sanitizeNickname(msg.nickname);
+  if (!nick) {
+    return { valid: false, error: 'Invalid nickname (1-20 chars, alphanumeric/underscore/dash)' };
+  }
+  if (!isValidBase64(msg.publicKey, PUBLIC_KEY_SIZE)) {
+    return { valid: false, error: 'Invalid public key' };
+  }
+  return { valid: true, nickname: nick };
+}
+
+export function validateEncryptedMessage(msg) {
+  if (!isString(msg.from) || !isString(msg.to)) {
+    return { valid: false, error: 'Missing from/to fields' };
+  }
+  if (!isObject(msg.payload)) {
+    return { valid: false, error: 'Missing payload' };
+  }
+  if (!isString(msg.payload.ciphertext) || !isString(msg.payload.nonce)) {
+    return { valid: false, error: 'Invalid payload structure' };
+  }
+  if (!isValidBase64(msg.payload.nonce, 24)) {
+    return { valid: false, error: 'Invalid nonce' };
+  }
+
+  // Ratcheted message: validate extra fields
+  if (msg.payload.ephemeralPublicKey !== undefined) {
+    if (!isValidBase64(msg.payload.ephemeralPublicKey, PUBLIC_KEY_SIZE)) {
+      return { valid: false, error: 'Invalid ephemeral public key' };
+    }
+    if (!Number.isInteger(msg.payload.counter) || msg.payload.counter < 0) {
+      return { valid: false, error: 'Invalid counter' };
+    }
+    if (!Number.isInteger(msg.payload.previousCounter) || msg.payload.previousCounter < 0) {
+      return { valid: false, error: 'Invalid previousCounter' };
+    }
+  }
+
+  return { valid: true };
+}
+
+export function validateKeyUpdate(msg) {
+  if (!isValidBase64(msg.publicKey, PUBLIC_KEY_SIZE)) {
+    return { valid: false, error: 'Invalid public key' };
+  }
+  return { valid: true };
+}
+
+export function validateChangeRoom(msg) {
+  if (!isString(msg.room) || msg.room.length === 0 || msg.room.length > 30) {
+    return { valid: false, error: 'Invalid room name (1-30 chars)' };
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(msg.room)) {
+    return { valid: false, error: 'Room name must be alphanumeric, dash or underscore' };
+  }
+  return { valid: true, room: msg.room.toLowerCase() };
+}
+
+export function validateListRooms() {
+  return { valid: true };
+}
+
+export function validateKickPeer(msg) {
+  const nick = sanitizeNickname(msg.targetNickname);
+  if (!nick) {
+    return { valid: false, error: 'Invalid target nickname' };
+  }
+  return {
+    valid: true,
+    targetNickname: nick,
+    reason: isString(msg.reason) ? msg.reason.slice(0, 200) : '',
+  };
+}
+
+export function validateMutePeer(msg) {
+  const nick = sanitizeNickname(msg.targetNickname);
+  if (!nick) {
+    return { valid: false, error: 'Invalid target nickname' };
+  }
+  if (!isNumber(msg.durationMs) || msg.durationMs <= 0) {
+    return { valid: false, error: 'Invalid mute duration' };
+  }
+  return { valid: true, targetNickname: nick, durationMs: msg.durationMs };
+}
+
+export function validateBanPeer(msg) {
+  const nick = sanitizeNickname(msg.targetNickname);
+  if (!nick) {
+    return { valid: false, error: 'Invalid target nickname' };
+  }
+  return {
+    valid: true,
+    targetNickname: nick,
+    reason: isString(msg.reason) ? msg.reason.slice(0, 200) : '',
+  };
+}
+
+export { sanitizeNickname };

package/src/server/CertManager.js

@@ -0,0 +1,173 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { generateKeyPairSync, createSign, createHash } from 'node:crypto';
+import { createLogger } from '../shared/logger.js';
+
+const log = createLogger('cert');
+
+const CERT_DIR = join(process.cwd(), 'certs');
+const KEY_PATH = join(CERT_DIR, 'server.key');
+const CERT_PATH = join(CERT_DIR, 'server.cert');
+
+/**
+ * Load or auto-generate self-signed TLS certificates.
+ * @returns {{ key: Buffer, cert: Buffer }}
+ */
+export function loadOrGenerateCerts() {
+  if (existsSync(KEY_PATH) && existsSync(CERT_PATH)) {
+    log.info('TLS certificates loaded from certs/');
+    return {
+      key: readFileSync(KEY_PATH),
+      cert: readFileSync(CERT_PATH),
+    };
+  }
+
+  log.info('Generating self-signed TLS certificate...');
+
+  if (!existsSync(CERT_DIR)) {
+    mkdirSync(CERT_DIR, { recursive: true });
+  }
+
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+
+  const cert = createSelfSignedCert(publicKey, privateKey);
+
+  writeFileSync(KEY_PATH, privateKey);
+  writeFileSync(CERT_PATH, cert);
+
+  log.info('Self-signed TLS certificate generated in certs/');
+  return { key: Buffer.from(privateKey), cert: Buffer.from(cert) };
+}
+
+/**
+ * Create a minimal self-signed X.509 certificate in PEM format.
+ */
+function createSelfSignedCert(publicKeyPem, privateKeyPem) {
+  // Build a basic X.509 v3 certificate using DER encoding
+  const now = new Date();
+  const notAfter = new Date(now);
+  notAfter.setFullYear(notAfter.getFullYear() + 1);
+
+  // Extract raw public key bytes from SPKI PEM
+  const spkiDer = pemToDer(publicKeyPem);
+
+  // Build TBS (To Be Signed) certificate
+  const serialNumber = createHash('sha256')
+    .update(Buffer.from(Date.now().toString()))
+    .digest()
+    .subarray(0, 8);
+
+  const issuer = derSequence([
+    derSet([
+      derSequence(
+        [
+          Buffer.from('550403', 'hex'), // OID: commonName
+          derUtf8('CipherMesh'),
+        ].map((b, i) => (i === 0 ? derOid(b) : b)),
+      ),
+    ]),
+  ]);
+
+  const validity = derSequence([derUtcTime(now), derUtcTime(notAfter)]);
+
+  const tbs = derSequence([
+    derExplicit(0, derInteger(2)), // version v3
+    derInteger(serialNumber),
+    derSequence([derOid(Buffer.from('2a864886f70d01010b', 'hex')), derNull()]), // sha256WithRSA
+    issuer,
+    validity,
+    issuer, // subject = issuer (self-signed)
+    Buffer.from(spkiDer), // subjectPublicKeyInfo
+  ]);
+
+  // Sign the TBS with SHA-256 + RSA
+  const signer = createSign('SHA256');
+  signer.update(tbs);
+  const signature = signer.sign(privateKeyPem);
+
+  // Build the full certificate
+  const cert = derSequence([
+    tbs,
+    derSequence([derOid(Buffer.from('2a864886f70d01010b', 'hex')), derNull()]),
+    derBitString(signature),
+  ]);
+
+  return derToPem(cert, 'CERTIFICATE');
+}
+
+// ── DER encoding helpers ─────────────────────────────────────
+
+function derTag(tag, content) {
+  const len = derLength(content.length);
+  return Buffer.concat([Buffer.from([tag]), len, content]);
+}
+
+function derLength(length) {
+  if (length < 0x80) {
+    return Buffer.from([length]);
+  }
+  if (length < 0x100) {
+    return Buffer.from([0x81, length]);
+  }
+  return Buffer.from([0x82, (length >> 8) & 0xff, length & 0xff]);
+}
+
+function derSequence(items) {
+  return derTag(0x30, Buffer.concat(items));
+}
+
+function derSet(items) {
+  return derTag(0x31, Buffer.concat(items));
+}
+
+function derInteger(value) {
+  const buf = Buffer.isBuffer(value) ? value : Buffer.from([value]);
+  // Prepend 0x00 if high bit is set (positive integer)
+  const padded = buf[0] & 0x80 ? Buffer.concat([Buffer.from([0]), buf]) : buf;
+  return derTag(0x02, padded);
+}
+
+function derOid(buf) {
+  return derTag(0x06, buf);
+}
+
+function derNull() {
+  return Buffer.from([0x05, 0x00]);
+}
+
+function derUtf8(str) {
+  return derTag(0x0c, Buffer.from(str, 'utf-8'));
+}
+
+function derUtcTime(date) {
+  const y = String(date.getUTCFullYear()).slice(-2);
+  const m = String(date.getUTCMonth() + 1).padStart(2, '0');
+  const d = String(date.getUTCDate()).padStart(2, '0');
+  const h = String(date.getUTCHours()).padStart(2, '0');
+  const min = String(date.getUTCMinutes()).padStart(2, '0');
+  const s = String(date.getUTCSeconds()).padStart(2, '0');
+  return derTag(0x17, Buffer.from(`${y}${m}${d}${h}${min}${s}Z`, 'ascii'));
+}
+
+function derBitString(content) {
+  return derTag(0x03, Buffer.concat([Buffer.from([0x00]), content]));
+}
+
+function derExplicit(tag, content) {
+  return derTag(0xa0 | tag, content);
+}
+
+function pemToDer(pem) {
+  const b64 = pem.replace(/-----[^-]+-----/g, '').replace(/\s/g, '');
+  return Buffer.from(b64, 'base64');
+}
+
+function derToPem(der, label) {
+  const b64 = der.toString('base64');
+  const lines = b64.match(/.{1,64}/g) || [];
+  return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;
+}

package/src/server/MessageRouter.js

@@ -0,0 +1,80 @@
+import { createLogger } from '../shared/logger.js';
+import { RATE_LIMIT_PER_SECOND } from '../shared/constants.js';
+import { createError, ERR } from '../protocol/messages.js';
+
+const log = createLogger('router');
+
+export class MessageRouter {
+  #sessionManager;
+  #offlineQueue;
+  #rateCounts; // Map<sessionId, { count, resetAt }>
+
+  constructor(sessionManager, offlineQueue) {
+    this.#sessionManager = sessionManager;
+    this.#offlineQueue = offlineQueue;
+    this.#rateCounts = new Map();
+  }
+
+  /**
+   * Route an encrypted_message from sender to recipient.
+   * The server NEVER inspects payload contents.
+   */
+  route(senderSessionId, msg) {
+    // Rate limit check
+    if (!this.#checkRateLimit(senderSessionId)) {
+      const senderSession = this.#sessionManager.getSession(senderSessionId);
+      if (senderSession?.ws.readyState === 1) {
+        senderSession.ws.send(
+          JSON.stringify(createError(ERR.RATE_LIMITED, 'Too many messages per second')),
+        );
+      }
+      return;
+    }
+
+    const recipientSession = this.#sessionManager.getSession(msg.to);
+    if (!recipientSession) {
+      // Try to enqueue for offline delivery
+      const leftPeer = this.#sessionManager.getRecentlyLeft(msg.to);
+      if (leftPeer) {
+        this.#offlineQueue.enqueue(leftPeer.nickname, leftPeer.publicKey, msg);
+        log.debug(`Message queued for ${leftPeer.nickname} (offline)`);
+        return;
+      }
+
+      const senderSession = this.#sessionManager.getSession(senderSessionId);
+      if (senderSession?.ws.readyState === 1) {
+        senderSession.ws.send(
+          JSON.stringify(createError(ERR.PEER_NOT_FOUND, 'Recipient not found')),
+        );
+      }
+      log.warn(`Peer ${msg.to?.slice(0, 8)} not found`);
+      return;
+    }
+
+    if (recipientSession.ws.readyState === 1) {
+      recipientSession.ws.send(JSON.stringify(msg));
+      log.debug(`${senderSessionId.slice(0, 8)} -> ${msg.to.slice(0, 8)}`);
+    }
+  }
+
+  #checkRateLimit(sessionId) {
+    const now = Date.now();
+    const entry = this.#rateCounts.get(sessionId);
+
+    if (!entry || now >= entry.resetAt) {
+      this.#rateCounts.set(sessionId, { count: 1, resetAt: now + 1000 });
+      return true;
+    }
+
+    if (entry.count >= RATE_LIMIT_PER_SECOND) {
+      return false;
+    }
+
+    entry.count++;
+    return true;
+  }
+
+  cleanupSession(sessionId) {
+    this.#rateCounts.delete(sessionId);
+  }
+}

package/src/server/OfflineQueue.js

@@ -0,0 +1,124 @@
+import { createLogger } from '../shared/logger.js';
+import {
+  OFFLINE_QUEUE_MAX_PER_PEER,
+  OFFLINE_QUEUE_MAX_AGE_MS,
+  OFFLINE_QUEUE_MAX_TOTAL,
+} from '../shared/constants.js';
+
+const log = createLogger('offline-queue');
+
+export class OfflineQueue {
+  #queues; // Map<nickname_lower, { publicKey, messages[] }>
+  #totalCount;
+
+  constructor() {
+    this.#queues = new Map();
+    this.#totalCount = 0;
+  }
+
+  /**
+   * Enqueue a message for an offline peer.
+   * @param {string} nickname - Peer's nickname
+   * @param {string} publicKey - Peer's public key (base64)
+   * @param {object} msg - The raw encrypted_message to store
+   */
+  enqueue(nickname, publicKey, msg) {
+    if (this.#totalCount >= OFFLINE_QUEUE_MAX_TOTAL) {
+      log.warn('Global offline queue full, dropping message');
+      return false;
+    }
+
+    const key = nickname.toLowerCase();
+    let entry = this.#queues.get(key);
+
+    if (!entry) {
+      entry = { publicKey, messages: [] };
+      this.#queues.set(key, entry);
+    }
+
+    if (entry.publicKey !== publicKey) {
+      log.debug(`PublicKey changed for ${nickname}, dropping old queue`);
+      this.#totalCount -= entry.messages.length;
+      entry.publicKey = publicKey;
+      entry.messages = [];
+    }
+
+    if (entry.messages.length >= OFFLINE_QUEUE_MAX_PER_PEER) {
+      log.warn(`Queue full for ${nickname}, dropping oldest message`);
+      entry.messages.shift();
+      this.#totalCount--;
+    }
+
+    entry.messages.push({ msg, queuedAt: Date.now() });
+    this.#totalCount++;
+
+    log.debug(`Message queued for ${nickname} (${entry.messages.length} in queue)`);
+    return true;
+  }
+
+  /**
+   * Dequeue all messages for a peer if publicKey matches.
+   * @param {string} nickname - Peer's nickname
+   * @param {string} publicKey - Peer's current public key (base64)
+   * @returns {object[]} Array of stored messages (may be empty)
+   */
+  dequeue(nickname, publicKey) {
+    const key = nickname.toLowerCase();
+    const entry = this.#queues.get(key);
+
+    if (!entry) {
+      return [];
+    }
+
+    if (entry.publicKey !== publicKey) {
+      log.info(`${nickname} reconnected with a different key, dropping queue`);
+      this.#totalCount -= entry.messages.length;
+      this.#queues.delete(key);
+      return [];
+    }
+
+    const now = Date.now();
+    const valid = entry.messages.filter((item) => now - item.queuedAt < OFFLINE_QUEUE_MAX_AGE_MS);
+
+    const expired = entry.messages.length - valid.length;
+    if (expired > 0) {
+      log.debug(`${expired} expired messages dropped for ${nickname}`);
+    }
+
+    this.#totalCount -= entry.messages.length;
+    this.#queues.delete(key);
+
+    log.info(`${valid.length} messages delivered to ${nickname}`);
+    return valid.map((item) => item.msg);
+  }
+
+  /**
+   * Remove expired entries across all queues.
+   */
+  cleanup() {
+    const now = Date.now();
+    let removed = 0;
+
+    for (const [key, entry] of this.#queues) {
+      const before = entry.messages.length;
+      entry.messages = entry.messages.filter(
+        (item) => now - item.queuedAt < OFFLINE_QUEUE_MAX_AGE_MS,
+      );
+      const diff = before - entry.messages.length;
+      removed += diff;
+      this.#totalCount -= diff;
+
+      if (entry.messages.length === 0) {
+        this.#queues.delete(key);
+      }
+    }
+
+    if (removed > 0) {
+      log.info(`Cleanup: ${removed} expired messages removed`);
+    }
+  }
+
+  get size() {
+    return this.#totalCount;
+  }
+}