nastech-app 1.0.0

package/sources/sync/encryption/artifactEncryption.ts

@@ -0,0 +1,83 @@
+import { decodeBase64, encodeBase64 } from '@/encryption/base64';
+import { ArtifactHeader, ArtifactBody } from '../artifactTypes';
+import { AES256Encryption } from './encryptor';
+import * as Random from 'expo-crypto';
+
+export class ArtifactEncryption {
+    private encryptor: AES256Encryption;
+    
+    constructor(dataEncryptionKey: Uint8Array) {
+        this.encryptor = new AES256Encryption(dataEncryptionKey);
+    }
+    
+    /**
+     * Generate a new data encryption key for an artifact
+     */
+    static generateDataEncryptionKey(): Uint8Array {
+        return Random.getRandomBytes(32);  // 256 bits for AES-256
+    }
+    
+    /**
+     * Encrypt artifact header
+     */
+    async encryptHeader(header: ArtifactHeader): Promise<string> {
+        const encrypted = await this.encryptor.encrypt([header]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+    
+    /**
+     * Decrypt artifact header
+     */
+    async decryptHeader(encryptedHeader: string): Promise<ArtifactHeader | null> {
+        try {
+            const encryptedData = decodeBase64(encryptedHeader, 'base64');
+            const decrypted = await this.encryptor.decrypt([encryptedData]);
+            if (!decrypted[0]) {
+                return null;
+            }
+            // Validate structure
+            const header = decrypted[0] as any;
+            if (typeof header !== 'object' || header === null) {
+                return null;
+            }
+            return {
+                title: typeof header.title === 'string' ? header.title : null
+            };
+        } catch (error) {
+            console.error('Failed to decrypt artifact header:', error);
+            return null;
+        }
+    }
+    
+    /**
+     * Encrypt artifact body
+     */
+    async encryptBody(body: ArtifactBody): Promise<string> {
+        const encrypted = await this.encryptor.encrypt([body]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+    
+    /**
+     * Decrypt artifact body
+     */
+    async decryptBody(encryptedBody: string): Promise<ArtifactBody | null> {
+        try {
+            const encryptedData = decodeBase64(encryptedBody, 'base64');
+            const decrypted = await this.encryptor.decrypt([encryptedData]);
+            if (!decrypted[0]) {
+                return null;
+            }
+            // Validate structure
+            const body = decrypted[0] as any;
+            if (typeof body !== 'object' || body === null) {
+                return null;
+            }
+            return {
+                body: typeof body.body === 'string' ? body.body : null
+            };
+        } catch (error) {
+            console.error('Failed to decrypt artifact body:', error);
+            return null;
+        }
+    }
+}

package/sources/sync/encryption/encryption.ts

@@ -0,0 +1,220 @@
+import { deriveKey } from "@/encryption/deriveKey";
+import { AES256Encryption, BoxEncryption, SecretBoxEncryption, Encryptor, Decryptor } from "./encryptor";
+import { encodeHex } from "@/encryption/hex";
+import { EncryptionCache } from "./encryptionCache";
+import { SessionEncryption } from "./sessionEncryption";
+import { MachineEncryption } from "./machineEncryption";
+import { encodeBase64, decodeBase64 } from "@/encryption/base64";
+import sodium from '@/encryption/libsodium.lib';
+import { decryptBox, encryptBox } from "@/encryption/libsodium";
+import { randomUUID } from 'expo-crypto';
+
+export class Encryption {
+
+    static async create(masterSecret: Uint8Array) {
+
+        // Derive content data key to open session and machine records
+        const contentDataKey = await deriveKey(masterSecret, 'Happy EnCoder', ['content']);
+
+        // Derive content data key keypair
+        const contentKeyPair = sodium.crypto_box_seed_keypair(contentDataKey);
+
+        // Derive anonymous ID
+        const anonID = encodeHex((await deriveKey(masterSecret, 'Happy Coder', ['analytics', 'id']))).slice(0, 16).toLowerCase();
+
+        // Derive master blob key for legacy sessions (those with no per-session dataKey)
+        const masterBlobKey = await deriveKey(masterSecret, 'Happy Blobs', ['master']);
+
+        // Create encryption
+        return new Encryption(anonID, masterSecret, contentKeyPair, masterBlobKey);
+    }
+
+    private readonly legacyEncryption: SecretBoxEncryption;
+    private readonly contentKeyPair: sodium.KeyPair;
+    private readonly masterBlobKey: Uint8Array;
+    readonly anonID: string;
+    readonly contentDataKey: Uint8Array;
+
+    // Session and machine encryption management
+    private sessionEncryptions = new Map<string, SessionEncryption>();
+    private machineEncryptions = new Map<string, MachineEncryption>();
+    private sessionBlobKeys = new Map<string, Uint8Array>();
+    private cache: EncryptionCache;
+
+    private constructor(anonID: string, masterSecret: Uint8Array, contentKeyPair: sodium.KeyPair, masterBlobKey: Uint8Array) {
+        this.anonID = anonID;
+        this.contentKeyPair = contentKeyPair;
+        this.legacyEncryption = new SecretBoxEncryption(masterSecret);
+        this.masterBlobKey = masterBlobKey;
+        this.cache = new EncryptionCache();
+        this.contentDataKey = contentKeyPair.publicKey;
+    }
+
+    //
+    // Core encryption opening
+    //
+
+    async openEncryption(dataEncryptionKey: Uint8Array | null): Promise<Encryptor & Decryptor> {
+        if (!dataEncryptionKey) {
+            return this.legacyEncryption;
+        }
+        return new AES256Encryption(dataEncryptionKey);
+    }
+
+    //
+    // Session operations
+    //
+
+    /**
+     * Initialize sessions with their encryption keys
+     * This should be called once when sessions are loaded
+     */
+    async initializeSessions(sessions: Map<string, Uint8Array | null>): Promise<void> {
+        for (const [sessionId, dataKey] of sessions) {
+            // Skip if already initialized
+            if (this.sessionEncryptions.has(sessionId)) {
+                continue;
+            }
+
+            // Create appropriate encryptor based on data key
+            const encryptor = await this.openEncryption(dataKey);
+
+            // Create and cache session encryption
+            const sessionEnc = new SessionEncryption(
+                sessionId,
+                encryptor,
+                this.cache
+            );
+            this.sessionEncryptions.set(sessionId, sessionEnc);
+
+            // Derive blob key for this session.
+            // Legacy sessions (null dataKey) use the master blob key.
+            // Newer sessions derive a subkey from their own dataKey so blobs
+            // are cryptographically isolated from message encryption.
+            const blobKey = dataKey
+                ? await deriveKey(dataKey, 'Happy Blobs', ['session'])
+                : this.masterBlobKey;
+            this.sessionBlobKeys.set(sessionId, blobKey);
+        }
+    }
+
+    /**
+     * Get session encryption if it has been initialized
+     * Returns null if not initialized (should never happen in normal flow)
+     */
+    getSessionEncryption(sessionId: string): SessionEncryption | null {
+        return this.sessionEncryptions.get(sessionId) || null;
+    }
+
+    /**
+     * Remove session encryption from memory when session is deleted
+     */
+    removeSessionEncryption(sessionId: string): void {
+        this.sessionEncryptions.delete(sessionId);
+        this.sessionBlobKeys.delete(sessionId);
+        // Also clear any cached data for this session
+        this.cache.clearSessionCache(sessionId);
+    }
+
+    /**
+     * Get the 32-byte NaCl secretbox key for encrypting binary blobs
+     * (image attachments) in a session. Distinct from the message encryption
+     * key to maintain cryptographic separation.
+     * Returns null if the session has not been initialized.
+     */
+    getSessionBlobKey(sessionId: string): Uint8Array | null {
+        return this.sessionBlobKeys.get(sessionId) ?? null;
+    }
+
+    //
+    // Machine operations
+    //
+
+    /**
+     * Initialize machines with their encryption keys
+     * This should be called once when machines are loaded
+     */
+    async initializeMachines(machines: Map<string, Uint8Array | null>): Promise<void> {
+        for (const [machineId, dataKey] of machines) {
+            // Skip if already initialized
+            if (this.machineEncryptions.has(machineId)) {
+                continue;
+            }
+
+            // Create appropriate encryptor based on data key
+            const encryptor = await this.openEncryption(dataKey);
+
+            // Create and cache machine encryption
+            const machineEnc = new MachineEncryption(
+                machineId,
+                encryptor,
+                this.cache
+            );
+            this.machineEncryptions.set(machineId, machineEnc);
+        }
+    }
+
+    /**
+     * Get machine encryption if it has been initialized
+     * Returns null if not initialized (should never happen in normal flow)
+     */
+    getMachineEncryption(machineId: string): MachineEncryption | null {
+        return this.machineEncryptions.get(machineId) || null;
+    }
+
+    /**
+     * Remove machine encryption from memory when the machine is deleted
+     */
+    removeMachineEncryption(machineId: string): void {
+        this.machineEncryptions.delete(machineId);
+    }
+
+    //
+    // Legacy methods for machine metadata (temporary until machines are migrated)
+    //
+
+    async encryptRaw(data: any): Promise<string> {
+        const encrypted = await this.legacyEncryption.encrypt([data]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+
+    async decryptRaw(encrypted: string): Promise<any | null> {
+        try {
+            const encryptedData = decodeBase64(encrypted, 'base64');
+            const decrypted = await this.legacyEncryption.decrypt([encryptedData]);
+            return decrypted[0] || null;
+        } catch (error) {
+            return null;
+        }
+    }
+
+    //
+    // Data Encryption Key decryption
+    //
+
+    async decryptEncryptionKey(encrypted: string) {
+        const encryptedKey = decodeBase64(encrypted, 'base64');
+        if (encryptedKey[0] !== 0) {
+            return null;
+        }
+
+        const decrypted = decryptBox(encryptedKey.slice(1), this.contentKeyPair.privateKey);
+        if (!decrypted) {
+            return null;
+        }
+        return decrypted;
+    }
+
+    async encryptEncryptionKey(key: Uint8Array): Promise<Uint8Array> {
+        // Use public key for encryption (encrypt TO ourselves)
+        const encrypted = encryptBox(key, this.contentKeyPair.publicKey);
+        const result = new Uint8Array(encrypted.length + 1);
+        result[0] = 0; // Version byte
+        result.set(encrypted, 1);
+        return result;
+    }
+
+    generateId(): string {
+        return randomUUID();
+    }
+}

package/sources/sync/encryption/encryptionCache.ts

@@ -0,0 +1,248 @@
+import { AgentState, Metadata, MachineMetadata } from '../storageTypes';
+import { DecryptedMessage } from '../storageTypes';
+
+interface CacheEntry<T> {
+    data: T;
+    accessTime: number;
+}
+
+/**
+ * In-memory cache for decrypted session data to avoid expensive re-decryption
+ * Uses sessionId + version as keys for agent state and metadata
+ * Uses messageId as key for messages (immutable)
+ */
+export class EncryptionCache {
+    private agentStateCache = new Map<string, CacheEntry<AgentState>>();
+    private metadataCache = new Map<string, CacheEntry<Metadata>>();
+    private messageCache = new Map<string, CacheEntry<DecryptedMessage>>();
+    private machineMetadataCache = new Map<string, CacheEntry<MachineMetadata>>();
+    private daemonStateCache = new Map<string, CacheEntry<any>>();
+    
+    // Configuration
+    private readonly maxAgentStates = 1000;
+    private readonly maxMetadata = 1000;
+    private readonly maxMessages = 1000;
+    private readonly maxMachineMetadata = 500;
+    private readonly maxDaemonStates = 500;
+
+    /**
+     * Get cached agent state for a session
+     */
+    getCachedAgentState(sessionId: string, version: number): AgentState | null {
+        const key = `${sessionId}:${version}`;
+        const entry = this.agentStateCache.get(key);
+        if (entry) {
+            entry.accessTime = Date.now();
+            return entry.data;
+        }
+        return null;
+    }
+
+    /**
+     * Cache agent state for a session
+     */
+    setCachedAgentState(sessionId: string, version: number, data: AgentState): void {
+        const key = `${sessionId}:${version}`;
+        this.agentStateCache.set(key, {
+            data,
+            accessTime: Date.now()
+        });
+        
+        // Evict if over limit
+        this.evictOldest(this.agentStateCache, this.maxAgentStates);
+    }
+
+    /**
+     * Get cached metadata for a session
+     */
+    getCachedMetadata(sessionId: string, version: number): Metadata | null {
+        const key = `${sessionId}:${version}`;
+        const entry = this.metadataCache.get(key);
+        if (entry) {
+            entry.accessTime = Date.now();
+            return entry.data;
+        }
+        return null;
+    }
+
+    /**
+     * Cache metadata for a session
+     */
+    setCachedMetadata(sessionId: string, version: number, data: Metadata): void {
+        const key = `${sessionId}:${version}`;
+        this.metadataCache.set(key, {
+            data,
+            accessTime: Date.now()
+        });
+        
+        // Evict if over limit
+        this.evictOldest(this.metadataCache, this.maxMetadata);
+    }
+
+    /**
+     * Get cached decrypted message
+     */
+    getCachedMessage(messageId: string): DecryptedMessage | null {
+        const entry = this.messageCache.get(messageId);
+        if (entry) {
+            entry.accessTime = Date.now();
+            return entry.data;
+        }
+        return null;
+    }
+
+    /**
+     * Cache decrypted message
+     */
+    setCachedMessage(messageId: string, data: DecryptedMessage): void {
+        this.messageCache.set(messageId, {
+            data,
+            accessTime: Date.now()
+        });
+        
+        // Evict if over limit
+        this.evictOldest(this.messageCache, this.maxMessages);
+    }
+
+    /**
+     * Get cached machine metadata
+     */
+    getCachedMachineMetadata(machineId: string, version: number): MachineMetadata | null {
+        const key = `${machineId}:${version}`;
+        const entry = this.machineMetadataCache.get(key);
+        if (entry) {
+            entry.accessTime = Date.now();
+            return entry.data;
+        }
+        return null;
+    }
+
+    /**
+     * Cache machine metadata
+     */
+    setCachedMachineMetadata(machineId: string, version: number, data: MachineMetadata): void {
+        const key = `${machineId}:${version}`;
+        this.machineMetadataCache.set(key, {
+            data,
+            accessTime: Date.now()
+        });
+        
+        // Evict if over limit
+        this.evictOldest(this.machineMetadataCache, this.maxMachineMetadata);
+    }
+
+    /**
+     * Get cached daemon state
+     */
+    getCachedDaemonState(machineId: string, version: number): any | undefined {
+        const key = `${machineId}:${version}`;
+        const entry = this.daemonStateCache.get(key);
+        if (entry) {
+            entry.accessTime = Date.now();
+            return entry.data;
+        }
+        return undefined;
+    }
+
+    /**
+     * Cache daemon state (including null values)
+     */
+    setCachedDaemonState(machineId: string, version: number, data: any): void {
+        const key = `${machineId}:${version}`;
+        this.daemonStateCache.set(key, {
+            data,
+            accessTime: Date.now()
+        });
+        
+        // Evict if over limit
+        this.evictOldest(this.daemonStateCache, this.maxDaemonStates);
+    }
+
+    /**
+     * Clear all cache entries for a specific machine
+     */
+    clearMachineCache(machineId: string): void {
+        // Clear machine metadata and daemon state for this machine (all versions)
+        for (const key of this.machineMetadataCache.keys()) {
+            if (key.startsWith(`${machineId}:`)) {
+                this.machineMetadataCache.delete(key);
+            }
+        }
+        
+        for (const key of this.daemonStateCache.keys()) {
+            if (key.startsWith(`${machineId}:`)) {
+                this.daemonStateCache.delete(key);
+            }
+        }
+    }
+
+    /**
+     * Clear all cache entries for a specific session
+     */
+    clearSessionCache(sessionId: string): void {
+        // Clear agent state and metadata for this session (all versions)
+        for (const key of this.agentStateCache.keys()) {
+            if (key.startsWith(`${sessionId}:`)) {
+                this.agentStateCache.delete(key);
+            }
+        }
+        
+        for (const key of this.metadataCache.keys()) {
+            if (key.startsWith(`${sessionId}:`)) {
+                this.metadataCache.delete(key);
+            }
+        }
+        
+        // Note: We don't clear messages as they're immutable and session-agnostic
+    }
+
+    /**
+     * Clear all cached data
+     */
+    clearAll(): void {
+        this.agentStateCache.clear();
+        this.metadataCache.clear();
+        this.messageCache.clear();
+        this.machineMetadataCache.clear();
+        this.daemonStateCache.clear();
+    }
+
+    /**
+     * Get cache statistics for debugging
+     */
+    getStats() {
+        return {
+            agentStates: this.agentStateCache.size,
+            metadata: this.metadataCache.size,
+            messages: this.messageCache.size,
+            machineMetadata: this.machineMetadataCache.size,
+            daemonStates: this.daemonStateCache.size,
+            totalEntries: this.agentStateCache.size + this.metadataCache.size + this.messageCache.size + 
+                         this.machineMetadataCache.size + this.daemonStateCache.size
+        };
+    }
+
+    /**
+     * Evict oldest entries when cache exceeds limit (LRU eviction)
+     */
+    private evictOldest<T>(cache: Map<string, CacheEntry<T>>, maxSize: number): void {
+        if (cache.size <= maxSize) {
+            return;
+        }
+
+        // Find oldest entry by access time
+        let oldestKey: string | null = null;
+        let oldestTime = Infinity;
+        
+        for (const [key, entry] of cache.entries()) {
+            if (entry.accessTime < oldestTime) {
+                oldestTime = entry.accessTime;
+                oldestKey = key;
+            }
+        }
+        
+        if (oldestKey) {
+            cache.delete(oldestKey);
+        }
+    }
+}