ciphermesh 2.1.0 → 2.3.0

package/src/server/WebSocketServer.js

@@ -21,6 +21,8 @@ import {
   createPeerLeft,
   createPeerKeyUpdated,
   createRoomChanged,
+  createRoomJoined,
+  createRoomLeft,
   createRoomChallenge,
   createRoomList,
   createPeerKicked,
@@ -34,6 +36,8 @@ import {
   validateEncryptedMessage,
   validateKeyUpdate,
   validateChangeRoom,
+  validateJoinRoom,
+  validateLeaveRoom,
   validateRoomAuth,
   validateKickPeer,
   validateMutePeer,
@@ -196,6 +200,14 @@ export class SecureWSServer {
         this.#handleChangeRoom(ws, msg);
         break;
 
+      case MSG.JOIN_ROOM:
+        this.#handleJoinRoom(ws, msg);
+        break;
+
+      case MSG.LEAVE_ROOM:
+        this.#handleLeaveRoom(ws, msg);
+        break;
+
       case MSG.ROOM_AUTH:
         this.#handleRoomAuth(ws, msg);
         break;
@@ -247,7 +259,13 @@ export class SecureWSServer {
     }
 
     const room = 'general';
-    const sessionId = this.#sessionManager.addSession(ws, validation.nickname, msg.publicKey, room);
+    const sessionId = this.#sessionManager.addSession(
+      ws,
+      validation.nickname,
+      msg.publicKey,
+      room,
+      validation.pqPublicKey,
+    );
     ws.sessionId = sessionId;
     ws.hasJoined = true;
     clearTimeout(ws.joinTimer);
@@ -280,6 +298,7 @@ export class SecureWSServer {
         sessionId,
         nickname: validation.nickname,
         publicKey: msg.publicKey,
+        ...(validation.pqPublicKey ? { pqPublicKey: validation.pqPublicKey } : {}),
       }),
       sessionId,
     );
@@ -328,20 +347,11 @@ export class SecureWSServer {
 
     this.#sessionManager.updatePublicKey(ws.sessionId, msg.publicKey);
 
-    // Broadcast new key to room peers
-    const room = this.#sessionManager.getSessionRoom(ws.sessionId);
-    if (room) {
-      this.#sessionManager.broadcastToRoom(
-        room,
-        createPeerKeyUpdated(ws.sessionId, msg.publicKey),
-        ws.sessionId,
-      );
-    } else {
-      this.#sessionManager.broadcast(
-        createPeerKeyUpdated(ws.sessionId, msg.publicKey),
-        ws.sessionId,
-      );
-    }
+    // Broadcast the new key once to every peer sharing at least one room.
+    this.#sessionManager.broadcastToPeersOf(
+      ws.sessionId,
+      createPeerKeyUpdated(ws.sessionId, msg.publicKey),
+    );
 
     log.info(`${ws.sessionId.slice(0, 8)} rotated keys`);
   }
@@ -390,13 +400,7 @@ export class SecureWSServer {
     // Joining a private room: don't switch yet — issue a challenge the client
     // must sign with the password-derived key (see #handleRoomAuth).
     if (this.#sessionManager.isRoomPrivate(validation.room)) {
-      const nonce = randomBytes(ROOM_CHALLENGE_NONCE_SIZE).toString('base64');
-      ws.roomChallenge = {
-        room: validation.room,
-        nonce,
-        expiresAt: Date.now() + ROOM_CHALLENGE_TTL_MS,
-      };
-      ws.send(JSON.stringify(createRoomChallenge(validation.room, nonce)));
+      this.#issueRoomChallenge(ws, validation.room, 'switch');
       return;
     }
 
@@ -410,6 +414,132 @@ export class SecureWSServer {
     this.#finishRoomSwitch(ws, session, result);
   }
 
+  // Multi-room: join an ADDITIONAL room, keeping current memberships.
+  #handleJoinRoom(ws, msg) {
+    if (!ws.hasJoined || !ws.sessionId) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
+      return;
+    }
+
+    const validation = validateJoinRoom(msg);
+    if (!validation.valid) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, validation.error)));
+      return;
+    }
+
+    const session = this.#sessionManager.getSession(ws.sessionId);
+    if (this.#sessionManager.isBanned(validation.room, session.nickname)) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are banned from this room')));
+      return;
+    }
+
+    // Creating a private room additively.
+    if (validation.roomAuthPk) {
+      if (validation.room === 'general' || this.#sessionManager.roomHasMembers(validation.room)) {
+        ws.send(
+          JSON.stringify(
+            createError(ERR.ROOM_EXISTS, 'Room already exists — join it with /join instead'),
+          ),
+        );
+        return;
+      }
+      const result = this.#sessionManager.joinAdditional(ws.sessionId, validation.room);
+      if (!result) {
+        ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are already in this room')));
+        return;
+      }
+      this.#sessionManager.setRoomPrivate(validation.room, validation.roomAuthPk);
+      this.#finishRoomJoin(ws, session, validation.room);
+      return;
+    }
+
+    if (this.#sessionManager.isRoomPrivate(validation.room)) {
+      this.#issueRoomChallenge(ws, validation.room, 'join');
+      return;
+    }
+
+    const result = this.#sessionManager.joinAdditional(ws.sessionId, validation.room);
+    if (!result) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are already in this room')));
+      return;
+    }
+    this.#finishRoomJoin(ws, session, validation.room);
+  }
+
+  // Multi-room: leave one room (never the last — a session is always somewhere).
+  #handleLeaveRoom(ws, msg) {
+    if (!ws.hasJoined || !ws.sessionId) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
+      return;
+    }
+
+    const validation = validateLeaveRoom(msg);
+    if (!validation.valid) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, validation.error)));
+      return;
+    }
+
+    const session = this.#sessionManager.getSession(ws.sessionId);
+    const result = this.#sessionManager.leaveOneRoom(ws.sessionId, validation.room);
+    if (!result) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are not in this room')));
+      return;
+    }
+    if (result.lastRoom) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Cannot leave your last room')));
+      return;
+    }
+
+    this.#sessionManager.broadcastToRoom(
+      validation.room,
+      createPeerLeft(ws.sessionId, session.nickname, validation.room),
+      ws.sessionId,
+    );
+    ws.send(JSON.stringify(createRoomLeft(validation.room)));
+    log.info(`${session.nickname} left room ${validation.room}`);
+  }
+
+  #issueRoomChallenge(ws, room, mode) {
+    const nonce = randomBytes(ROOM_CHALLENGE_NONCE_SIZE).toString('base64');
+    ws.roomChallenge = {
+      room,
+      nonce,
+      mode, // 'switch' (change_room) or 'join' (additive join_room)
+      expiresAt: Date.now() + ROOM_CHALLENGE_TTL_MS,
+    };
+    ws.send(JSON.stringify(createRoomChallenge(room, nonce)));
+  }
+
+  // Shared tail of an additive join: notify the room and confirm to the joiner.
+  #finishRoomJoin(ws, session, room) {
+    this.#sessionManager.broadcastToRoom(
+      room,
+      createPeerJoined(
+        {
+          sessionId: ws.sessionId,
+          nickname: session.nickname,
+          publicKey: session.publicKey,
+          ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+        },
+        room,
+      ),
+      ws.sessionId,
+    );
+
+    const peers = this.#sessionManager.getRoomPeers(room, ws.sessionId);
+    const roomJoined = createRoomJoined(room, peers, this.#sessionManager.isRoomPrivate(room));
+    const ownerSid = this.#sessionManager.getRoomOwner(room);
+    if (ownerSid) {
+      const ownerSess = this.#sessionManager.getSession(ownerSid);
+      if (ownerSess) {
+        roomJoined.roomOwner = ownerSess.nickname;
+      }
+    }
+    ws.send(JSON.stringify(roomJoined));
+
+    log.info(`${session.nickname} joined room ${room} (additive)`);
+  }
+
   #handleRoomAuth(ws, msg) {
     if (!ws.hasJoined || !ws.sessionId) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
@@ -481,6 +611,17 @@ export class SecureWSServer {
       return;
     }
 
+    // Complete whichever action requested the challenge.
+    if (challenge.mode === 'join') {
+      const result = this.#sessionManager.joinAdditional(ws.sessionId, validation.room);
+      if (!result) {
+        ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are already in this room')));
+        return;
+      }
+      this.#finishRoomJoin(ws, session, validation.room);
+      return;
+    }
+
     const result = this.#sessionManager.switchRoom(ws.sessionId, validation.room);
     if (!result) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are already in this room')));
@@ -490,24 +631,33 @@ export class SecureWSServer {
     this.#finishRoomSwitch(ws, session, result);
   }
 
-  // Shared tail of a successful room switch: notify both rooms and send the
-  // ROOM_CHANGED (with the private flag) to the mover.
+  // Shared tail of a successful room switch: notify every old room and send
+  // the ROOM_CHANGED (with the private flag) to the mover.
   #finishRoomSwitch(ws, session, result) {
-    // Notify old room that peer left
-    this.#sessionManager.broadcastToRoom(
-      result.oldRoom,
-      createPeerLeft(ws.sessionId, session.nickname),
-      ws.sessionId,
-    );
+    // Notify each old room that the peer left it
+    for (const oldRoom of result.oldRooms || [result.oldRoom]) {
+      if (!oldRoom) {
+        continue;
+      }
+      this.#sessionManager.broadcastToRoom(
+        oldRoom,
+        createPeerLeft(ws.sessionId, session.nickname, oldRoom),
+        ws.sessionId,
+      );
+    }
 
     // Notify new room that peer joined
     this.#sessionManager.broadcastToRoom(
       result.newRoom,
-      createPeerJoined({
-        sessionId: ws.sessionId,
-        nickname: session.nickname,
-        publicKey: session.publicKey,
-      }),
+      createPeerJoined(
+        {
+          sessionId: ws.sessionId,
+          nickname: session.nickname,
+          publicKey: session.publicKey,
+          ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+        },
+        result.newRoom,
+      ),
       ws.sessionId,
     );
 
@@ -540,6 +690,28 @@ export class SecureWSServer {
     ws.send(JSON.stringify(createRoomList(rooms)));
   }
 
+  // Which room a moderation command targets: the explicit `room` field (must
+  // be one the moderator is in), else the session's only room. Owners in
+  // several rooms must say which one.
+  #resolveModerationRoom(ws, explicitRoom, cmdName) {
+    if (explicitRoom) {
+      if (!this.#sessionManager.isInRoom(ws.sessionId, explicitRoom)) {
+        ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are not in that room')));
+        return null;
+      }
+      return explicitRoom;
+    }
+    const only = this.#sessionManager.getSessionRoom(ws.sessionId);
+    if (!only) {
+      ws.send(
+        JSON.stringify(
+          createError(ERR.INVALID_MESSAGE, `You are in several rooms — specify one for ${cmdName}`),
+        ),
+      );
+    }
+    return only;
+  }
+
   #handleKickPeer(ws, msg) {
     if (!ws.hasJoined || !ws.sessionId) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
@@ -552,7 +724,10 @@ export class SecureWSServer {
       return;
     }
 
-    const room = this.#sessionManager.getSessionRoom(ws.sessionId);
+    const room = this.#resolveModerationRoom(ws, validation.room, '/kick');
+    if (!room) {
+      return;
+    }
     if (!this.#sessionManager.isRoomOwner(room, ws.sessionId)) {
       ws.send(
         JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Only the room owner can use /kick')),
@@ -568,8 +743,7 @@ export class SecureWSServer {
       return;
     }
 
-    const targetRoom = this.#sessionManager.getSessionRoom(targetSessionId);
-    if (targetRoom !== room) {
+    if (!this.#sessionManager.isInRoom(targetSessionId, room)) {
       ws.send(
         JSON.stringify(
           createError(ERR.PEER_NOT_FOUND, `"${validation.targetNickname}" is not in this room`),
@@ -614,7 +788,10 @@ export class SecureWSServer {
       return;
     }
 
-    const room = this.#sessionManager.getSessionRoom(ws.sessionId);
+    const room = this.#resolveModerationRoom(ws, validation.room, '/mute');
+    if (!room) {
+      return;
+    }
     if (!this.#sessionManager.isRoomOwner(room, ws.sessionId)) {
       ws.send(
         JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Only the room owner can use /mute')),
@@ -630,8 +807,7 @@ export class SecureWSServer {
       return;
     }
 
-    const targetRoom = this.#sessionManager.getSessionRoom(targetSessionId);
-    if (targetRoom !== room) {
+    if (!this.#sessionManager.isInRoom(targetSessionId, room)) {
       ws.send(
         JSON.stringify(
           createError(ERR.PEER_NOT_FOUND, `"${validation.targetNickname}" is not in this room`),
@@ -663,7 +839,10 @@ export class SecureWSServer {
       return;
     }
 
-    const room = this.#sessionManager.getSessionRoom(ws.sessionId);
+    const room = this.#resolveModerationRoom(ws, validation.room, '/ban');
+    if (!room) {
+      return;
+    }
     if (!this.#sessionManager.isRoomOwner(room, ws.sessionId)) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Only the room owner can use /ban')));
       return;
@@ -677,8 +856,7 @@ export class SecureWSServer {
       return;
     }
 
-    const targetRoom = this.#sessionManager.getSessionRoom(targetSessionId);
-    if (targetRoom !== room) {
+    if (!this.#sessionManager.isInRoom(targetSessionId, room)) {
       ws.send(
         JSON.stringify(
           createError(ERR.PEER_NOT_FOUND, `"${validation.targetNickname}" is not in this room`),
@@ -716,21 +894,17 @@ export class SecureWSServer {
       return;
     }
 
-    const room = this.#sessionManager.getSessionRoom(ws.sessionId);
+    const rooms = this.#sessionManager.getSessionRooms(ws.sessionId);
     const session = this.#sessionManager.removeSession(ws.sessionId);
     this.#messageRouter.cleanupSession(ws.sessionId);
 
     if (session) {
-      // Broadcast to former room members only
-      if (room) {
+      // One peer_left per former room, tagged, so multi-room clients drop the
+      // peer from exactly the right buffers.
+      for (const room of rooms) {
         this.#sessionManager.broadcastToRoom(
           room,
-          createPeerLeft(ws.sessionId, session.nickname),
-          ws.sessionId,
-        );
-      } else {
-        this.#sessionManager.broadcast(
-          createPeerLeft(ws.sessionId, session.nickname),
+          createPeerLeft(ws.sessionId, session.nickname, room),
           ws.sessionId,
         );
       }