ciphermesh 2.10.0 → 2.12.0

package/src/server/WebSocketServer.js

@@ -11,6 +11,7 @@ import {
   ROOM_CHALLENGE_TTL_MS,
   ROOM_AUTH_MAX_FAILS,
   ROOM_AUTH_FAIL_WINDOW_MS,
+  SERVER_CAPABILITIES,
 } from '../shared/constants.js';
 import {
   MSG,
@@ -32,6 +33,7 @@ import {
   parseMessage,
   validateJoin,
   validateEncryptedMessage,
+  validateGroupMessage,
   validateKeyUpdate,
   validateChangeRoom,
   validateJoinRoom,
@@ -230,6 +232,10 @@ export class SecureWSServer {
         this.#handleEncryptedMessage(ws, msg);
         break;
 
+      case MSG.GROUP_MESSAGE:
+        this.#handleGroupMessage(ws, msg);
+        break;
+
       case MSG.KEY_UPDATE:
         this.#handleKeyUpdate(ws, msg);
         break;
@@ -303,6 +309,7 @@ export class SecureWSServer {
       msg.publicKey,
       room,
       validation.pqPublicKey,
+      validation.capabilities,
     );
     ws.sessionId = sessionId;
     ws.hasJoined = true;
@@ -313,7 +320,7 @@ export class SecureWSServer {
 
     // Send ACK with peer list (room-scoped)
     const peers = this.#sessionManager.getRoomPeers(room, sessionId);
-    const joinAck = createJoinAck(sessionId, peers, queued.length, room);
+    const joinAck = createJoinAck(sessionId, peers, queued.length, room, SERVER_CAPABILITIES);
     const ownerSid = this.#sessionManager.getRoomOwner(room);
     if (ownerSid) {
       const ownerSession = this.#sessionManager.getSession(ownerSid);
@@ -340,6 +347,7 @@ export class SecureWSServer {
         nickname: validation.nickname,
         publicKey: msg.publicKey,
         ...(validation.pqPublicKey ? { pqPublicKey: validation.pqPublicKey } : {}),
+        ...(validation.capabilities.length ? { caps: [...validation.capabilities] } : {}),
       }),
       sessionId,
     );
@@ -374,6 +382,63 @@ export class SecureWSServer {
     this.#messageRouter.route(ws.sessionId, msg);
   }
 
+  // One ciphertext in, one copy to each member of the room. The relay reads the
+  // room and nothing else: no `to` to route by, and no `from` to stamp on the
+  // way out — a room-addressed envelope must not become the one place the relay
+  // asserts who is speaking.
+  #handleGroupMessage(ws, msg) {
+    if (!ws.hasJoined || !ws.sessionId) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
+      return;
+    }
+
+    if (this.#sessionManager.isMuted(ws.sessionId)) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'You are muted')));
+      return;
+    }
+
+    const validation = validateGroupMessage(msg);
+    if (!validation.valid) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, validation.error)));
+      return;
+    }
+
+    // A member may only address a room it is in. Without this, one connection
+    // could inject into every room on the hub at once — the per-peer path has no
+    // equivalent, because it needs a sessionId it could only have been told.
+    if (!this.#sessionManager.isInRoom(ws.sessionId, validation.room)) {
+      ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Not in that room')));
+      return;
+    }
+
+    // Same per-sender budget as the unicast path. One frame in now costs the
+    // relay N frames out instead of one, so the limit that used to be applied
+    // N times per line is applied once — charging less here than there would
+    // turn the saving into an amplifier.
+    if (!this.#messageRouter.allowFrom(ws.sessionId)) {
+      ws.send(JSON.stringify(createError(ERR.RATE_LIMITED, 'Too many messages per second')));
+      return;
+    }
+
+    // Deliberately NOT queued for absent members, unlike the unicast path.
+    //
+    // A member who was away could not read it anyway: a sender key handed over
+    // on their return serialises the chain at its *current* counter, so anything
+    // sent while they were gone stays shut — the forward secrecy the ratchet
+    // buys, pinned in chat-controller.test.js. Queueing would therefore store
+    // ciphertext on the relay that provably nobody can open: all of the cost and
+    // the liability of holding it, and none of the delivery.
+    //
+    // The unicast queue survives because an envelope addressed to a peer is
+    // still openable when they come back with the same key. That is not true
+    // here, and it is the difference that decides it.
+    delete msg.from;
+    this.#sessionManager.broadcastToRoom(validation.room, msg, ws.sessionId);
+    // Never log the sender or the room membership this reveals — only that a
+    // fan-out happened. Correlating would defeat what sealed sender buys.
+    log.debug('group message fanned out');
+  }
+
   #handleKeyUpdate(ws, msg) {
     if (!ws.hasJoined || !ws.sessionId) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'JOIN first')));
@@ -711,6 +776,27 @@ export class SecureWSServer {
     this.#finishRoomSwitch(ws, session, result);
   }
 
+  // One session stopped being in one room. Every way out of a room ends here:
+  // leaving, switching, disconnecting, and — since this was the gap — being
+  // kicked or banned.
+  //
+  // Kick and ban used to announce only `peer_kicked`, which carries a nickname
+  // and no session. Clients had nothing to remove a member *by*, so the removed
+  // peer stayed in every remaining roster. Harmless-looking while the relay path
+  // seals one envelope per peer; not harmless at all once a room encrypts once
+  // to a shared chain, because "who is still in this room" is then the input to
+  // when that chain must be rotated away from someone.
+  #emitRoomDeparture(room, sessionId, nickname) {
+    if (!room || !sessionId) {
+      return;
+    }
+    this.#sessionManager.broadcastToRoom(
+      room,
+      createPeerLeft(sessionId, nickname || 'Unknown', room),
+      sessionId,
+    );
+  }
+
   // Shared tail of a successful room switch: notify every old room and send
   // the ROOM_CHANGED (with the private flag) to the mover.
   #finishRoomSwitch(ws, session, result) {
@@ -837,11 +923,14 @@ export class SecureWSServer {
     if (result) {
       const targetSession = this.#sessionManager.getSession(targetSessionId);
 
-      // Notify old room
+      // Notify old room. The kick goes first so a client can mark the session
+      // before the peer_left lands and report it as a kick rather than a
+      // departure; both travel the same socket, so the order holds.
       this.#sessionManager.broadcastToRoom(
         room,
-        createPeerKicked(validation.targetNickname, validation.reason),
+        createPeerKicked(validation.targetNickname, validation.reason, targetSessionId),
       );
+      this.#emitRoomDeparture(room, targetSessionId, targetSession?.nickname);
 
       // Notify target with room change + kick reason
       const newPeers = this.#sessionManager.getRoomPeers('general', targetSessionId);
@@ -953,8 +1042,9 @@ export class SecureWSServer {
     if (result) {
       this.#sessionManager.broadcastToRoom(
         room,
-        createPeerKicked(validation.targetNickname, validation.reason || 'banned'),
+        createPeerKicked(validation.targetNickname, validation.reason || 'banned', targetSessionId),
       );
+      this.#emitRoomDeparture(room, targetSessionId, targetSession?.nickname);
 
       const newPeers = this.#sessionManager.getRoomPeers('general', targetSessionId);
       targetSession.ws.send(JSON.stringify(createRoomChanged('general', newPeers)));

package/src/shared/constants.js

@@ -1,5 +1,40 @@
 export const PROTOCOL_VERSION = 2; // v2: sealed sender (encrypted_message carries `sealed`, no `from`)
 
+// ── Capability negotiation ─────────────────────────────────────
+// PROTOCOL_VERSION is an exact-equality gate, so it cannot express "newer, but
+// still able to talk to you". Capabilities fill that gap: a client lists what it
+// can do in JOIN, the relay hands the list on verbatim with the peer list, and a
+// feature turns on only when every member of the room advertises it. Absent or
+// empty means an older peer, which is the safe default rather than an error.
+export const CAP = {
+  // Group encryption on the relay path — one ciphertext for the whole room
+  // instead of one sealed envelope per peer. See
+  // docs/design/sender-keys-on-relay.md.
+  //
+  // From a client it means "I can *receive* a group message": I accept a sender
+  // key over the pairwise channel and can decrypt what that chain produces.
+  // From the relay it means "I can fan a room-addressed message out". Receive
+  // and fan-out land a release before anyone sends, so that by the time a sender
+  // exists, every advertised room can already read it.
+  SENDER_KEYS: 'sk1',
+};
+
+// What this client advertises. SENDER_KEYS is honest here: the receive path
+// exists. Nothing sends group messages yet.
+export const OWN_CAPABILITIES = [CAP.SENDER_KEYS];
+
+// What the relay advertises, in join_ack. A client cannot promise this on the
+// relay's behalf — the fan-out is the relay's job — so a sender has to check the
+// room *and* the hub it is sitting on before switching paths.
+export const SERVER_CAPABILITIES = [CAP.SENDER_KEYS];
+
+// Bounds. This list arrives from a public hub, so it is attacker-controlled.
+export const MAX_CAPABILITIES = 16;
+export const MAX_CAPABILITY_LENGTH = 24;
+
+// Ed25519 detached signature on a group message (src/crypto/SenderKey.js).
+export const SIGNATURE_SIZE = 64;
+
 // Network
 export const SERVER_PORT = 3600;
 export const HEARTBEAT_INTERVAL_MS = 30_000;