dignity.js 0.1.2 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dignity.js",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "P2P object API for decentralized JavaScript applications",
   "main": "dist/dignity.cjs.js",
   "module": "dist/dignity.esm.js",
@@ -23,6 +23,7 @@
   "scripts": {
     "test": "jest --coverage",
     "test:unit": "jest tests/unit --runInBand",
+    "test:cloudflare-live": "RUN_CLOUDFLARE_LIVE_TESTS=1 jest tests/integration/cloudflare-signaling-live.test.js --runInBand",
     "test:pow-calibrate": "jest tests/unit/sloth-vdf-timing.test.js --runInBand",
     "build": "node scripts/build.js",
     "docs:serve": "npx http-server docs -p 4173 -o",
@@ -38,12 +39,13 @@
     "rest",
     "objects"
   ],
-  "license": "MIT",
+  "license": "Apache 2.0",
   "devDependencies": {
     "esbuild": "^0.28.0",
     "jest": "^29.7.0"
   },
   "dependencies": {
+    "peerjs": "^1.5.5",
     "tweetnacl": "^1.0.3",
     "tweetnacl-util": "^0.15.1"
   },

package/src/index.js

@@ -10,6 +10,7 @@ const DignityP2P = require('./core/dignity-p2p');
 const createDefaultSignalingPool = require('./signaling/create-default-signaling-pool');
 const SignalingPool = require('./signaling/signaling-pool');
 const WebSocketSignalingProvider = require('./signaling/websocket-signaling-provider');
+const PeerJSSignalingProvider = require('./signaling/peerjs-signaling-provider');
 const {
   InMemoryNetworkHub,
   InMemoryNetworkAdapter
@@ -30,6 +31,7 @@ module.exports = {
   createDefaultSignalingPool,
   SignalingPool,
   WebSocketSignalingProvider,
+  PeerJSSignalingProvider,
   InMemoryNetworkHub,
   InMemoryNetworkAdapter,
   DEFAULT_CLOUDFLARE_SIGNALING_URLS,

package/src/security/message-security-service.js

@@ -12,7 +12,8 @@ const DEFAULT_SECURITY_OPTIONS = {
   broadcastPasswords: {},
   resolveBroadcastPassword: null,
   powSteps: 22,
-  trustedPeerKeys: {}
+  trustedPeerKeys: {},
+  kdfIterations: 100000
 };
 
 function stableStringify(value) {
@@ -47,6 +48,37 @@ function utf8ToBytes(value) {
   return naclUtil.decodeUTF8(value);
 }
 
+async function deriveBroadcastKey(password, salt, iterations) {
+  const subtle = globalThis.crypto && globalThis.crypto.subtle;
+
+  if (subtle) {
+    const keyMaterial = await subtle.importKey(
+      'raw',
+      utf8ToBytes(password),
+      'PBKDF2',
+      false,
+      ['deriveBits']
+    );
+    const bits = await subtle.deriveBits(
+      { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },
+      keyMaterial,
+      256
+    );
+    return new Uint8Array(bits);
+  }
+
+  try {
+    const { pbkdf2Sync } = require('crypto');
+    return new Uint8Array(pbkdf2Sync(password, Buffer.from(salt), iterations, 32, 'sha256'));
+  } catch (_ignored) {
+    return hash32(concatBytes(utf8ToBytes(password), salt));
+  }
+}
+
+function legacyBroadcastKey(password, salt) {
+  return hash32(concatBytes(utf8ToBytes(password), salt));
+}
+
 function normalizePeerPublicKey(publicKey) {
   if (!publicKey || typeof publicKey !== 'object') {
     throw new Error('Public key must be an object with signingPublicKey and encryptionPublicKey');
@@ -153,6 +185,7 @@ class MessageSecurityService {
       const pow = await this.generatePow(envelope);
       envelope.security.pow = {
         enabled: true,
+        messageHash: pow.messageHash,
         challenge: pow.challenge,
         proof: pow.proof,
         steps: pow.steps,
@@ -208,6 +241,10 @@ class MessageSecurityService {
     });
   }
 
+  computePowMessageHash(envelope) {
+    return bytesToHex(hash32(utf8ToBytes(this.canonicalPowInput(envelope))));
+  }
+
   async decryptIncomingMessage(envelope) {
     if (!this.options.enabled) {
       return {
@@ -235,7 +272,7 @@ class MessageSecurityService {
       this.verifySignature(envelope);
     }
 
-    const payload = this.decryptPayload(envelope);
+    const payload = await this.decryptPayload(envelope);
 
     return {
       ignored: false,
@@ -315,7 +352,8 @@ class MessageSecurityService {
     const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
     const salt = nacl.randomBytes(16);
     const password = this.resolveBroadcastPassword(scope);
-    const key = hash32(concatBytes(utf8ToBytes(password), salt));
+    const iterations = this.options.kdfIterations || DEFAULT_SECURITY_OPTIONS.kdfIterations;
+    const key = await deriveBroadcastKey(password, salt, iterations);
     const encrypted = nacl.secretbox(plainText, nonce, key);
 
     return {
@@ -325,12 +363,14 @@ class MessageSecurityService {
         mode: 'broadcast',
         scope,
         nonce: naclUtil.encodeBase64(nonce),
-        salt: naclUtil.encodeBase64(salt)
+        salt: naclUtil.encodeBase64(salt),
+        kdf: 'pbkdf2',
+        kdfIterations: iterations
       }
     };
   }
 
-  decryptPayload(envelope) {
+  async decryptPayload(envelope) {
     const encryption = envelope.security ? envelope.security.encryption : null;
 
     if (!encryption || !encryption.enabled || !this.options.encryptionEnabled) {
@@ -344,7 +384,15 @@ class MessageSecurityService {
       const password = this.resolveBroadcastPassword(scope);
       const salt = naclUtil.decodeBase64(encryption.salt);
       const nonce = naclUtil.decodeBase64(encryption.nonce);
-      const key = hash32(concatBytes(utf8ToBytes(password), salt));
+
+      let key;
+      if (encryption.kdf === 'pbkdf2') {
+        const iterations = encryption.kdfIterations || DEFAULT_SECURITY_OPTIONS.kdfIterations;
+        key = await deriveBroadcastKey(password, salt, iterations);
+      } else {
+        key = legacyBroadcastKey(password, salt);
+      }
+
       const decrypted = nacl.secretbox.open(encryptedBuffer, nonce, key);
 
       if (!decrypted) {
@@ -420,13 +468,15 @@ class MessageSecurityService {
   }
 
   async generatePow(envelope) {
-    const challenge = bytesToHex(hash32(utf8ToBytes(this.canonicalPowInput(envelope))));
+    const messageHash = this.computePowMessageHash(envelope);
+    const challenge = messageHash;
     const steps = await this.determinePowSteps();
     const start = this.now();
     const proof = await VDF.compute(challenge, steps);
     const durationMs = this.now() - start;
 
     return {
+      messageHash,
       challenge,
       proof,
       steps: steps.toString(),
@@ -435,16 +485,21 @@ class MessageSecurityService {
   }
 
   async verifyPow(envelope) {
-    const expectedChallenge = bytesToHex(hash32(utf8ToBytes(this.canonicalPowInput(envelope))));
+    const expectedMessageHash = this.computePowMessageHash(envelope);
     const pow = envelope.security.pow;
 
-    if (!pow || pow.challenge !== expectedChallenge) {
+    if (
+      !pow ||
+      !pow.messageHash ||
+      pow.messageHash !== expectedMessageHash ||
+      pow.challenge !== pow.messageHash
+    ) {
       const error = new Error('PoW challenge mismatch');
       error.code = 'INVALID_POW';
       throw error;
     }
 
-    const verified = await VDF.verify(pow.challenge, BigInt(pow.steps), pow.proof);
+    const verified = await VDF.verify(pow.messageHash, BigInt(pow.steps), pow.proof);
     if (!verified) {
       const error = new Error('PoW verification failed');
       error.code = 'INVALID_POW';
@@ -458,5 +513,7 @@ class MessageSecurityService {
 module.exports = {
   MessageSecurityService,
   stableStringify,
+  deriveBroadcastKey,
+  legacyBroadcastKey,
   DEFAULT_SECURITY_OPTIONS
 };

package/src/signaling/create-default-signaling-pool.js

@@ -1,5 +1,6 @@
 const SignalingPool = require('./signaling-pool');
 const WebSocketSignalingProvider = require('./websocket-signaling-provider');
+const PeerJSSignalingProvider = require('./peerjs-signaling-provider');
 const {
   DEFAULT_CLOUDFLARE_SIGNALING_URLS,
   DEFAULT_SIGNALING_FALLBACK_URLS
@@ -13,8 +14,11 @@ function createDefaultSignalingPool(options = {}) {
   const providers = [];
 
   cloudflareUrls.forEach((url, index) => {
+    const usePeerJsProvider = /^wss:\/\/(peerjs\.92k\.de|0\.peerjs\.com)(\/|$)/.test(url);
+    const ProviderClass = usePeerJsProvider ? PeerJSSignalingProvider : WebSocketSignalingProvider;
+
     providers.push(
-      new WebSocketSignalingProvider({
+      new ProviderClass({
         id: `cloudflare-${index + 1}`,
         url,
         WebSocketImpl,

package/src/signaling/default-signaling-config.js

@@ -1,7 +1,6 @@
 const DEFAULT_CLOUDFLARE_SIGNALING_URLS = [
-  'wss://signaling.cloudflare.com',
-  'wss://cloudflare-webrtc-signaling.example',
-  'wss://trycloudflare-signaling.example'
+  'wss://peerjs.92k.de/peerjs?key=peerjs',
+  'wss://0.peerjs.com/peerjs?key=peerjs'
 ];
 
 const DEFAULT_SIGNALING_FALLBACK_URLS = [

package/src/signaling/peerjs-signaling-provider.js

@@ -0,0 +1,210 @@
+const WebSocketSignalingProvider = require('./websocket-signaling-provider');
+
+class PeerJSSignalingProvider {
+  constructor({ id, url, PeerImpl, WebSocketImpl, priority = 0, connectTimeoutMs = 10000 }) {
+    if (!url) {
+      throw new Error('PeerJS signaling provider requires a url');
+    }
+
+    this.id = id || url;
+    this.url = url;
+    this.priority = priority;
+    this.isCustomPeerImpl = Boolean(PeerImpl);
+    this.PeerImpl = PeerImpl || this.resolvePeerImplementation();
+    this.WebSocketImpl = WebSocketImpl;
+    this.connectTimeoutMs = connectTimeoutMs;
+    this.peer = null;
+    this.peerId = null;
+    this.connections = new Map();
+    this.messageHandlers = new Set();
+    this.fallbackProvider = null;
+  }
+
+  resolvePeerImplementation() {
+    try {
+      const peerjs = require('peerjs');
+      return peerjs.Peer || peerjs;
+    } catch (error) {
+      return null;
+    }
+  }
+
+  parsePeerJsServerUrl() {
+    const parsed = new URL(this.url);
+    const secure = parsed.protocol === 'wss:';
+    const host = parsed.hostname;
+    const port = parsed.port ? Number(parsed.port) : secure ? 443 : 80;
+    const path = parsed.pathname || '/';
+    const key = parsed.searchParams.get('key') || 'peerjs';
+
+    return { secure, host, port, path, key };
+  }
+
+  shouldUseWebSocketFallback() {
+    return !this.isCustomPeerImpl && typeof globalThis.RTCPeerConnection !== 'function';
+  }
+
+  useWebSocketFallback() {
+    if (!this.fallbackProvider) {
+      this.fallbackProvider = new WebSocketSignalingProvider({
+        id: `${this.id}-ws-fallback`,
+        url: this.url,
+        WebSocketImpl: this.WebSocketImpl,
+        priority: this.priority
+      });
+    }
+    return this.fallbackProvider;
+  }
+
+  async connect() {
+    if (this.shouldUseWebSocketFallback()) {
+      await this.useWebSocketFallback().connect();
+      return;
+    }
+
+    if (!this.PeerImpl) {
+      throw new Error('PeerJS implementation is not available');
+    }
+
+    const server = this.parsePeerJsServerUrl();
+    const peerId = `dignityjs_${Math.random().toString(36).slice(2, 12)}`;
+
+    await new Promise((resolve, reject) => {
+      const peer = new this.PeerImpl(peerId, {
+        host: server.host,
+        port: server.port,
+        path: server.path,
+        secure: server.secure,
+        key: server.key
+      });
+
+      const timeout = setTimeout(() => {
+        reject(new Error(`Unable to connect to signaling url ${this.url}`));
+      }, this.connectTimeoutMs);
+
+      peer.on('open', () => {
+        clearTimeout(timeout);
+        this.peer = peer;
+        this.peerId = peerId;
+        resolve();
+      });
+
+      peer.on('connection', (connection) => {
+        this.attachConnectionHandlers(connection);
+      });
+
+      peer.on('error', async (error) => {
+        clearTimeout(timeout);
+        if (error && error.type === 'browser-incompatible') {
+          try {
+            await this.useWebSocketFallback().connect();
+            resolve();
+            return;
+          } catch (fallbackError) {
+            reject(new Error(`Unable to connect to signaling url ${this.url}`));
+            return;
+          }
+        }
+        reject(new Error(`Unable to connect to signaling url ${this.url}`));
+      });
+    });
+  }
+
+  attachConnectionHandlers(connection) {
+    const remoteId = connection.peer;
+    this.connections.set(remoteId, connection);
+
+    connection.on('data', (payload) => {
+      for (const handler of this.messageHandlers) {
+        handler(payload);
+      }
+    });
+
+    connection.on('close', () => {
+      this.connections.delete(remoteId);
+    });
+  }
+
+  async openConnection(remotePeerId) {
+    if (!this.peer) {
+      throw new Error('PeerJS is not connected');
+    }
+
+    const existing = this.connections.get(remotePeerId);
+    if (existing && existing.open) {
+      return existing;
+    }
+
+    return await new Promise((resolve, reject) => {
+      const connection = this.peer.connect(remotePeerId, { reliable: true, serialization: 'json' });
+      const timeout = setTimeout(() => {
+        reject(new Error(`Unable to connect peer ${remotePeerId} via ${this.url}`));
+      }, this.connectTimeoutMs);
+
+      connection.on('open', () => {
+        clearTimeout(timeout);
+        this.attachConnectionHandlers(connection);
+        resolve(connection);
+      });
+
+      connection.on('error', () => {
+        clearTimeout(timeout);
+        reject(new Error(`Unable to connect peer ${remotePeerId} via ${this.url}`));
+      });
+    });
+  }
+
+  onMessage(handler) {
+    if (this.fallbackProvider) {
+      this.fallbackProvider.onMessage(handler);
+      return;
+    }
+    this.messageHandlers.add(handler);
+  }
+
+  async send(message) {
+    if (this.fallbackProvider) {
+      await this.fallbackProvider.send(message);
+      return;
+    }
+
+    if (!this.peer) {
+      throw new Error(`Signaling socket is not open for ${this.url}`);
+    }
+
+    if (message && message.to) {
+      const connection = await this.openConnection(message.to);
+      connection.send(message);
+      return;
+    }
+
+    for (const connection of this.connections.values()) {
+      if (connection.open) {
+        connection.send(message);
+      }
+    }
+  }
+
+  async disconnect() {
+    if (this.fallbackProvider) {
+      await this.fallbackProvider.disconnect();
+      this.fallbackProvider = null;
+      return;
+    }
+
+    for (const connection of this.connections.values()) {
+      if (typeof connection.close === 'function') {
+        connection.close();
+      }
+    }
+    this.connections.clear();
+
+    if (this.peer && typeof this.peer.destroy === 'function') {
+      this.peer.destroy();
+    }
+    this.peer = null;
+    this.peerId = null;
+  }
+}
+
+module.exports = PeerJSSignalingProvider;

package/src/signaling/websocket-signaling-provider.js

@@ -18,7 +18,7 @@ class WebSocketSignalingProvider {
     }
 
     await new Promise((resolve, reject) => {
-      const socket = new this.WebSocketImpl(this.url);
+      const socket = new this.WebSocketImpl(this.buildConnectionUrl());
 
       socket.onopen = () => {
         this.socket = socket;
@@ -44,6 +44,29 @@ class WebSocketSignalingProvider {
     });
   }
 
+  buildConnectionUrl() {
+    const peerJsHostPattern = /^wss:\/\/(peerjs\.92k\.de|0\.peerjs\.com)(\/|$)/;
+    if (!peerJsHostPattern.test(this.url)) {
+      return this.url;
+    }
+
+    const connectionId = `dignityjs_${Math.random().toString(36).slice(2, 12)}`;
+    const token = Math.random().toString(36).slice(2, 12);
+    const hasQuery = this.url.includes('?');
+    const hasId = /[?&]id=/.test(this.url);
+    const hasToken = /[?&]token=/.test(this.url);
+
+    let url = this.url;
+    if (!hasId) {
+      url += `${hasQuery ? '&' : '?'}id=${connectionId}`;
+    }
+    if (!hasToken) {
+      url += `${url.includes('?') ? '&' : '?'}token=${token}`;
+    }
+
+    return url;
+  }
+
   onMessage(handler) {
     this.messageHandlers.add(handler);
   }