nastech-app 1.0.0

package/sources/sync/encryption/encryptor.appspec.ts

@@ -0,0 +1,409 @@
+import { describe, it, expect } from '@/dev/testRunner';
+import { SecretBoxEncryption, BoxEncryption, AES256Encryption } from './encryptor';
+import { getRandomBytes } from 'expo-crypto';
+
+describe('SecretBoxEncryption', () => {
+    it('should encrypt and decrypt single Uint8Array', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        const originalData = new TextEncoder().encode('Hello, World!');
+        const encrypted = await encryptor.encrypt([originalData]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(1);
+        expect(decrypted[0]).toEqual(originalData);
+    });
+
+    it('should encrypt and decrypt multiple Uint8Arrays', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        const data1 = new TextEncoder().encode('First message');
+        const data2 = new TextEncoder().encode('Second message');
+        const data3 = new TextEncoder().encode('Third message');
+        
+        const encrypted = await encryptor.encrypt([data1, data2, data3]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(3);
+        expect(decrypted[0]).toEqual(data1);
+        expect(decrypted[1]).toEqual(data2);
+        expect(decrypted[2]).toEqual(data3);
+    });
+
+    it('should handle empty arrays', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        const encrypted = await encryptor.encrypt([]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(encrypted.length).toBe(0);
+        expect(decrypted.length).toBe(0);
+    });
+
+    it('should produce different ciphertext for same plaintext (due to random nonce)', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        const originalData = new TextEncoder().encode('Same message');
+        const encrypted1 = await encryptor.encrypt([originalData]);
+        const encrypted2 = await encryptor.encrypt([originalData]);
+        
+        // Ciphertexts should be different due to random nonce
+        expect(encrypted1[0]).not.toEqual(encrypted2[0]);
+        
+        // But both should decrypt to the same plaintext
+        const decrypted1 = await encryptor.decrypt(encrypted1);
+        const decrypted2 = await encryptor.decrypt(encrypted2);
+        
+        expect(decrypted1[0]).toEqual(originalData);
+        expect(decrypted2[0]).toEqual(originalData);
+    });
+
+    it('should fail decryption with wrong key', async () => {
+        const secretKey1 = getRandomBytes(32);
+        const secretKey2 = getRandomBytes(32);
+        
+        const encryptor1 = new SecretBoxEncryption(secretKey1);
+        const encryptor2 = new SecretBoxEncryption(secretKey2);
+        
+        const originalData = new TextEncoder().encode('Secret message');
+        const encrypted = await encryptor1.encrypt([originalData]);
+        const decrypted = await encryptor2.decrypt(encrypted);
+        
+        expect(decrypted[0]).toBe(null);
+    });
+
+    it('should handle moderate size data', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        // Create a moderate array (10KB instead of 1MB)
+        const largeData = new Uint8Array(10 * 1024);
+        for (let i = 0; i < largeData.length; i++) {
+            largeData[i] = i % 256;
+        }
+        
+        const encrypted = await encryptor.encrypt([largeData]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(1);
+        expect(decrypted[0]).toEqual(largeData);
+    });
+
+    it('should handle 500 individual items separately', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new SecretBoxEncryption(secretKey);
+        
+        // Create 500 individual items
+        const originalItems = [];
+        for (let i = 0; i < 500; i++) {
+            originalItems.push(new TextEncoder().encode(`Item ${i}: This is test data for item number ${i}`));
+        }
+        
+        // Encrypt each item individually
+        const encryptedItems = [];
+        for (const item of originalItems) {
+            const encrypted = await encryptor.encrypt([item]);
+            encryptedItems.push(encrypted[0]);
+        }
+        
+        // Decrypt each item individually
+        const decryptedItems = [];
+        for (const encryptedItem of encryptedItems) {
+            const decrypted = await encryptor.decrypt([encryptedItem]);
+            decryptedItems.push(decrypted[0]);
+        }
+        
+        // Verify all items match
+        expect(decryptedItems.length).toBe(500);
+        for (let i = 0; i < 500; i++) {
+            expect(decryptedItems[i]).toEqual(originalItems[i]);
+        }
+    });
+});
+
+describe('BoxEncryption', () => {
+    it('should encrypt and decrypt single Uint8Array', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        const originalData = new TextEncoder().encode('Hello, Box!');
+        const encrypted = await encryptor.encrypt([originalData]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(1);
+        expect(decrypted[0]).toEqual(originalData);
+    });
+
+    it('should encrypt and decrypt multiple Uint8Arrays', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        const data1 = new TextEncoder().encode('Box message 1');
+        const data2 = new TextEncoder().encode('Box message 2');
+        const data3 = new TextEncoder().encode('Box message 3');
+        
+        const encrypted = await encryptor.encrypt([data1, data2, data3]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(3);
+        expect(decrypted[0]).toEqual(data1);
+        expect(decrypted[1]).toEqual(data2);
+        expect(decrypted[2]).toEqual(data3);
+    });
+
+    it('should handle empty arrays', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        const encrypted = await encryptor.encrypt([]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(encrypted.length).toBe(0);
+        expect(decrypted.length).toBe(0);
+    });
+
+    it('should generate consistent public key from seed', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor1 = new BoxEncryption(seed);
+        const encryptor2 = new BoxEncryption(seed);
+        
+        // Both instances with same secret key should generate same public key
+        // We can't directly access the public key, but we can verify
+        // that data encrypted by one can be decrypted by the other
+        const originalData = new TextEncoder().encode('Test consistency');
+        const encrypted = await encryptor1.encrypt([originalData]);
+        const decrypted = await encryptor2.decrypt(encrypted);
+        
+        expect(decrypted[0]).toEqual(originalData);
+    });
+
+    it('should produce different ciphertext for same plaintext (ephemeral keys)', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        const originalData = new TextEncoder().encode('Same box message');
+        const encrypted1 = await encryptor.encrypt([originalData]);
+        const encrypted2 = await encryptor.encrypt([originalData]);
+        
+        // Ciphertexts should be different due to ephemeral keys
+        expect(encrypted1[0]).not.toEqual(encrypted2[0]);
+        
+        // But both should decrypt to the same plaintext
+        const decrypted1 = await encryptor.decrypt(encrypted1);
+        const decrypted2 = await encryptor.decrypt(encrypted2);
+        
+        expect(decrypted1[0]).toEqual(originalData);
+        expect(decrypted2[0]).toEqual(originalData);
+    });
+
+    it('should fail decryption with wrong key', async () => {
+        const seed1 = getRandomBytes(32);
+        const seed2 = getRandomBytes(32);
+        
+        const encryptor1 = new BoxEncryption(seed1);
+        const encryptor2 = new BoxEncryption(seed2);
+        
+        const originalData = new TextEncoder().encode('Secret box message');
+        const encrypted = await encryptor1.encrypt([originalData]);
+        const decrypted = await encryptor2.decrypt(encrypted);
+        
+        expect(decrypted[0]).toBe(null);
+    });
+
+    it('should handle moderate size data', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        // Create a moderate array (10KB instead of 1MB)
+        const largeData = new Uint8Array(10 * 1024);
+        for (let i = 0; i < largeData.length; i++) {
+            largeData[i] = (i * 3) % 256;
+        }
+        
+        const encrypted = await encryptor.encrypt([largeData]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(1);
+        expect(decrypted[0]).toEqual(largeData);
+    });
+
+    it('should handle mixed data sizes in batch', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        const small = new TextEncoder().encode('Small');
+        const medium = new Uint8Array(512);
+        for (let i = 0; i < medium.length; i++) {
+            medium[i] = i % 256;
+        }
+        const large = new Uint8Array(5 * 1024);  // 5KB instead of 100KB
+        for (let i = 0; i < large.length; i++) {
+            large[i] = (i * 7) % 256;
+        }
+        
+        const encrypted = await encryptor.encrypt([small, medium, large]);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(3);
+        expect(decrypted[0]).toEqual(small);
+        expect(decrypted[1]).toEqual(medium);
+        expect(decrypted[2]).toEqual(large);
+    });
+
+    it('should handle 500 individual items separately', async () => {
+        const seed = getRandomBytes(32);
+        const encryptor = new BoxEncryption(seed);
+        
+        // Create 500 individual items
+        const originalItems = [];
+        for (let i = 0; i < 500; i++) {
+            originalItems.push(new TextEncoder().encode(`Box Item ${i}: This is test data for box encryption item ${i}`));
+        }
+        
+        // Encrypt each item individually
+        const encryptedItems = [];
+        for (const item of originalItems) {
+            const encrypted = await encryptor.encrypt([item]);
+            encryptedItems.push(encrypted[0]);
+        }
+        
+        // Decrypt each item individually
+        const decryptedItems = [];
+        for (const encryptedItem of encryptedItems) {
+            const decrypted = await encryptor.decrypt([encryptedItem]);
+            decryptedItems.push(decrypted[0]);
+        }
+        
+        // Verify all items match
+        expect(decryptedItems.length).toBe(500);
+        for (let i = 0; i < 500; i++) {
+            expect(decryptedItems[i]).toEqual(originalItems[i]);
+        }
+    });
+});
+
+describe('AES256Encryption', () => {
+    it('should encrypt and decrypt single Uint8Array', async () => {
+        const secretKey = getRandomBytes(32);
+        const encryptor = new AES256Encryption(secretKey);
+        
+        const encrypted = await encryptor.encrypt(['Hello, AES!']);
+        const decrypted = await encryptor.decrypt(encrypted);
+        
+        expect(decrypted.length).toBe(1);
+        expect(decrypted[0]).toEqual('Hello, AES!');
+    });
+
+    // it('should encrypt and decrypt multiple Uint8Arrays', async () => {
+    //     const secretKey = getRandomBytes(32);
+    //     const encryptor = new AES256Encryption(secretKey);
+        
+    //     const data1 = new TextEncoder().encode('AES message 1');
+    //     const data2 = new TextEncoder().encode('AES message 2');
+    //     const data3 = new TextEncoder().encode('AES message 3');
+        
+    //     const encrypted = await encryptor.encrypt([data1, data2, data3]);
+    //     const decrypted = await encryptor.decrypt(encrypted);
+        
+    //     expect(decrypted.length).toBe(3);
+    //     expect(decrypted[0]).toEqual(data1);
+    //     expect(decrypted[1]).toEqual(data2);
+    //     expect(decrypted[2]).toEqual(data3);
+    // });
+
+    // it('should handle empty arrays', async () => {
+    //     const secretKey = getRandomBytes(32);
+    //     const encryptor = new AES256Encryption(secretKey);
+        
+    //     const encrypted = await encryptor.encrypt([]);
+    //     const decrypted = await encryptor.decrypt(encrypted);
+        
+    //     expect(encrypted.length).toBe(0);
+    //     expect(decrypted.length).toBe(0);
+    // });
+
+    // it('should produce different ciphertext for same plaintext (due to random IV)', async () => {
+    //     const secretKey = getRandomBytes(32);
+    //     const encryptor = new AES256Encryption(secretKey);
+        
+    //     const originalData = new TextEncoder().encode('Same AES message');
+    //     const encrypted1 = await encryptor.encrypt([originalData]);
+    //     const encrypted2 = await encryptor.encrypt([originalData]);
+        
+    //     // Ciphertexts should be different due to random IV
+    //     expect(encrypted1[0]).not.toEqual(encrypted2[0]);
+        
+    //     // But both should decrypt to the same plaintext
+    //     const decrypted1 = await encryptor.decrypt(encrypted1);
+    //     const decrypted2 = await encryptor.decrypt(encrypted2);
+        
+    //     expect(decrypted1[0]).toEqual(originalData);
+    //     expect(decrypted2[0]).toEqual(originalData);
+    // });
+
+    // it('should fail decryption with wrong key', async () => {
+    //     const secretKey1 = getRandomBytes(32);
+    //     const secretKey2 = getRandomBytes(32);
+        
+    //     const encryptor1 = new AES256Encryption(secretKey1);
+    //     const encryptor2 = new AES256Encryption(secretKey2);
+        
+    //     const originalData = new TextEncoder().encode('Secret AES message');
+    //     const encrypted = await encryptor1.encrypt([originalData]);
+    //     const decrypted = await encryptor2.decrypt(encrypted);
+        
+    //     expect(decrypted[0]).toBe(null);
+    // });
+
+    // it('should handle moderate size data', async () => {
+    //     const secretKey = getRandomBytes(32);
+    //     const encryptor = new AES256Encryption(secretKey);
+        
+    //     // Create a moderate array (10KB)
+    //     const largeData = new Uint8Array(10 * 1024);
+    //     for (let i = 0; i < largeData.length; i++) {
+    //         largeData[i] = (i * 5) % 100;
+    //     }
+        
+    //     const encrypted = await encryptor.encrypt([largeData]);
+    //     const decrypted = await encryptor.decrypt(encrypted);
+        
+    //     expect(decrypted.length).toBe(1);
+    //     expect(decrypted[0]).toEqual(largeData);
+    // });
+
+    // it('should handle 500 individual items separately', async () => {
+    //     const secretKey = getRandomBytes(32);
+    //     const encryptor = new AES256Encryption(secretKey);
+        
+    //     // Create 500 individual items
+    //     const originalItems = [];
+    //     for (let i = 0; i < 500; i++) {
+    //         originalItems.push(new TextEncoder().encode(`AES Item ${i}: This is test data for AES encryption item ${i}`));
+    //     }
+        
+    //     // Encrypt each item individually
+    //     const encryptedItems = [];
+    //     for (const item of originalItems) {
+    //         const encrypted = await encryptor.encrypt([item]);
+    //         encryptedItems.push(encrypted[0]);
+    //     }
+        
+    //     // Decrypt each item individually
+    //     const decryptedItems = [];
+    //     for (const encryptedItem of encryptedItems) {
+    //         const decrypted = await encryptor.decrypt([encryptedItem]);
+    //         decryptedItems.push(decrypted[0]);
+    //     }
+        
+    //     // Verify all items match
+    //     expect(decryptedItems.length).toBe(500);
+    //     for (let i = 0; i < 500; i++) {
+    //         expect(decryptedItems[i]).toEqual(originalItems[i]);
+    //     }
+    // });
+});

package/sources/sync/encryption/encryptor.ts

@@ -0,0 +1,126 @@
+import { decryptBox, decryptSecretBox, encryptBox, encryptSecretBox } from "@/encryption/libsodium";
+import { encodeBase64, decodeBase64 } from "@/encryption/base64";
+import sodium from '@/encryption/libsodium.lib';
+import { decodeUTF8, encodeUTF8 } from "@/encryption/text";
+import { decryptAESGCMString, encryptAESGCMString } from "@/encryption/aes";
+
+//
+// IMPORTANT: Right now there is a bug in the AES implementation and it works only with a normal strings converted to Uint8Array. 
+// Any abnormal string might break encoding and decoding utf8.
+//
+
+export interface Encryptor {
+    encrypt(data: any[]): Promise<Uint8Array[]>;
+}
+
+export interface Decryptor {
+    decrypt(data: Uint8Array[]): Promise<(any | null)[]>;
+}
+
+export class SecretBoxEncryption implements Encryptor, Decryptor {
+    private readonly secretKey: Uint8Array;
+
+    constructor(secretKey: Uint8Array) {
+        this.secretKey = secretKey;
+    }
+
+    async decrypt(data: Uint8Array[]): Promise<(any | null)[]> {
+        // Process as batch, not Promise.all - more efficient
+        const results: (any | null)[] = [];
+        for (const item of data) {
+            results.push(decryptSecretBox(item, this.secretKey));
+        }
+        return results;
+    }
+
+    async encrypt(data: any[]): Promise<Uint8Array[]> {
+        // Process as batch, not Promise.all - more efficient
+        const results: Uint8Array[] = [];
+        for (const item of data) {
+            results.push(encryptSecretBox(item, this.secretKey));
+        }
+        return results;
+    }
+}
+
+export class BoxEncryption implements Encryptor, Decryptor {
+    private readonly privateKey: Uint8Array;
+    private readonly publicKey: Uint8Array;
+
+    constructor(seed: Uint8Array) {
+        // Use the seed to generate a proper keypair
+        const keypair = sodium.crypto_box_seed_keypair(seed);
+        this.privateKey = keypair.privateKey;
+        this.publicKey = keypair.publicKey;
+    }
+
+    async encrypt(data: any[]): Promise<Uint8Array[]> {
+        // Process as batch, not Promise.all - more efficient
+        const results: Uint8Array[] = [];
+        for (const item of data) {
+            results.push(encryptBox(encodeUTF8(JSON.stringify(item)), this.publicKey));
+        }
+        return results;
+    }
+
+    async decrypt(data: Uint8Array[]): Promise<(any | null)[]> {
+        // Process as batch, not Promise.all - more efficient
+        const results: (any | null)[] = [];
+        for (const item of data) {
+            let decrypted = decryptBox(item, this.privateKey);
+            if (!decrypted) {
+                results.push(null);
+                continue;
+            }
+            results.push(JSON.parse(decodeUTF8(decrypted)));
+        }
+        return results;
+    }
+}
+
+export class AES256Encryption implements Encryptor, Decryptor {
+    private readonly secretKey: Uint8Array;
+    private readonly secretKeyB64: string;
+
+    constructor(secretKey: Uint8Array) {
+        this.secretKey = secretKey;
+        this.secretKeyB64 = encodeBase64(secretKey);
+    }
+
+    async encrypt(data: any[]): Promise<Uint8Array[]> {
+        // Process as batch, not Promise.all - more efficient
+        const results: Uint8Array[] = [];
+        for (const item of data) {
+            // Serialize to JSON string first
+            const encrypted = decodeBase64(await encryptAESGCMString(JSON.stringify(item), this.secretKeyB64));
+            let output = new Uint8Array(encrypted.length + 1);
+            output[0] = 0;
+            output.set(encrypted, 1);
+            results.push(output);
+        }
+        return results;
+    }
+
+    async decrypt(data: Uint8Array[]): Promise<(any | null)[]> {
+        // Decrypt items concurrently. The previous implementation used a
+        // sequential for-await loop, which serialised every AES-GCM call on
+        // the JS thread. For a 1000-message session that meant ~1000
+        // serialised crypto operations before the UI could display anything.
+        // Promise.all schedules them on the microtask queue, allowing the
+        // crypto subtle backend (and any native bridge work) to interleave.
+        return Promise.all(data.map(async (item) => {
+            try {
+                if (item[0] !== 0) {
+                    return null;
+                }
+                const decryptedString = await decryptAESGCMString(encodeBase64(item.slice(1)), this.secretKeyB64);
+                if (!decryptedString) {
+                    return null;
+                }
+                return JSON.parse(decryptedString);
+            } catch (error) {
+                return null;
+            }
+        }));
+    }
+}

package/sources/sync/encryption/machineEncryption.ts

@@ -0,0 +1,122 @@
+import { decodeBase64, encodeBase64 } from '@/encryption/base64';
+import { MachineMetadata, MachineMetadataSchema } from '../storageTypes';
+import { EncryptionCache } from './encryptionCache';
+import { Decryptor, Encryptor } from './encryptor';
+
+export class MachineEncryption {
+    private machineId: string;
+    private encryptor: Encryptor & Decryptor;
+    private cache: EncryptionCache;
+
+    constructor(
+        machineId: string,
+        encryptor: Encryptor & Decryptor,
+        cache: EncryptionCache
+    ) {
+        this.machineId = machineId;
+        this.encryptor = encryptor;
+        this.cache = cache;
+    }
+
+    /**
+     * Encrypt machine metadata
+     */
+    async encryptMetadata(metadata: MachineMetadata): Promise<string> {
+        const encrypted = await this.encryptor.encrypt([metadata]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+
+    /**
+     * Decrypt machine metadata with caching
+     */
+    async decryptMetadata(version: number, encrypted: string): Promise<MachineMetadata | null> {
+        // Check cache first
+        const cached = this.cache.getCachedMachineMetadata(this.machineId, version);
+        if (cached) {
+            return cached;
+        }
+
+        // Decrypt if not cached
+        try {
+            const encryptedData = decodeBase64(encrypted, 'base64');
+            const decrypted = await this.encryptor.decrypt([encryptedData]);
+            if (!decrypted[0]) {
+                return null;
+            }
+            
+            const parsed = MachineMetadataSchema.safeParse(decrypted[0]);
+            if (!parsed.success) {
+                console.error('Failed to parse machine metadata:', parsed.error);
+                return null;
+            }
+
+            // Cache the result
+            this.cache.setCachedMachineMetadata(this.machineId, version, parsed.data);
+            return parsed.data;
+        } catch (error) {
+            console.error('Failed to decrypt machine metadata:', error);
+            return null;
+        }
+    }
+
+    /**
+     * Encrypt daemon state
+     */
+    async encryptDaemonState(state: any): Promise<string> {
+        const encrypted = await this.encryptor.encrypt([state]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+
+    /**
+     * Decrypt daemon state with caching
+     */
+    async decryptDaemonState(version: number, encrypted: string | null | undefined): Promise<any | null> {
+        if (!encrypted) {
+            return null;
+        }
+
+        // Check cache first
+        const cached = this.cache.getCachedDaemonState(this.machineId, version);
+        if (cached !== undefined) {
+            return cached;
+        }
+
+        // Decrypt if not cached
+        try {
+            const encryptedData = decodeBase64(encrypted, 'base64');
+            const decrypted = await this.encryptor.decrypt([encryptedData]);
+            const result = decrypted[0] || null;
+            
+            // Cache the result (including null values)
+            this.cache.setCachedDaemonState(this.machineId, version, result);
+            return result;
+        } catch (error) {
+            console.error('Failed to decrypt daemon state:', error);
+            // Cache null result to avoid repeated decryption attempts
+            this.cache.setCachedDaemonState(this.machineId, version, null);
+            return null;
+        }
+    }
+
+    /**
+     * Encrypt raw data using machine-specific encryption
+     */
+    async encryptRaw(data: any): Promise<string> {
+        const encrypted = await this.encryptor.encrypt([data]);
+        return encodeBase64(encrypted[0], 'base64');
+    }
+
+    /**
+     * Decrypt raw data using machine-specific encryption
+     */
+    async decryptRaw(encrypted: string): Promise<any | null> {
+        try {
+            const encryptedData = decodeBase64(encrypted, 'base64');
+            const decrypted = await this.encryptor.decrypt([encryptedData]);
+            return decrypted[0] || null;
+        } catch (error) {
+            console.error('Failed to decrypt raw data:', error);
+            return null;
+        }
+    }
+}