nastech-app 1.0.0

package/sources/encryption/hmac_sha512.ts

@@ -0,0 +1,42 @@
+import * as Crypto from 'expo-crypto';
+
+export async function hmac_sha512(key: Uint8Array, data: Uint8Array): Promise<Uint8Array> {    
+    const blockSize = 128; // SHA512 block size in bytes
+    const opad = 0x5c;
+    const ipad = 0x36;
+    
+    // Prepare key
+    let actualKey = key;
+    if (key.length > blockSize) {
+        // If key is longer than block size, hash it
+        const keyHash = await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA512, new Uint8Array(key));
+        actualKey = new Uint8Array(keyHash);
+    }
+    
+    // Pad key to block size
+    const paddedKey = new Uint8Array(blockSize);
+    paddedKey.set(actualKey);
+    
+    // Create inner and outer padded keys
+    const innerKey = new Uint8Array(blockSize);
+    const outerKey = new Uint8Array(blockSize);
+    
+    for (let i = 0; i < blockSize; i++) {
+        innerKey[i] = paddedKey[i] ^ ipad;
+        outerKey[i] = paddedKey[i] ^ opad;
+    }
+    
+    // Inner hash: SHA512(innerKey || data)
+    const innerData = new Uint8Array(blockSize + data.length);
+    innerData.set(innerKey);
+    innerData.set(data, blockSize);
+    const innerHash = await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA512, innerData);
+    
+    // Outer hash: SHA512(outerKey || innerHash)
+    const outerData = new Uint8Array(blockSize + 64); // 64 bytes for SHA512 hash
+    outerData.set(outerKey);
+    outerData.set(new Uint8Array(innerHash), blockSize);
+    const finalHash = await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA512, outerData);
+    
+    return new Uint8Array(finalHash);
+}

package/sources/encryption/libsodium.lib.ts

@@ -0,0 +1,2 @@
+import sodium from '@more-tech/react-native-libsodium';
+export default sodium;

package/sources/encryption/libsodium.lib.web.ts

@@ -0,0 +1,2 @@
+import sodium from 'libsodium-wrappers';
+export default sodium;

package/sources/encryption/libsodium.ts

@@ -0,0 +1,58 @@
+import { getRandomBytes } from 'expo-crypto';
+import sodium from '@/encryption/libsodium.lib';
+
+export function getPublicKeyForBox(secretKey: Uint8Array): Uint8Array {
+    return sodium.crypto_box_seed_keypair(secretKey).publicKey;
+}
+
+export function encryptBox(data: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array {
+    const ephemeralKeyPair = sodium.crypto_box_keypair();
+    const nonce = getRandomBytes(sodium.crypto_box_NONCEBYTES);
+    const encrypted = sodium.crypto_box_easy(data, nonce, recipientPublicKey, ephemeralKeyPair.privateKey);
+
+    // Bundle format: ephemeral public key (32 bytes) + nonce (24 bytes) + encrypted data
+    const result = new Uint8Array(ephemeralKeyPair.publicKey.length + nonce.length + encrypted.length);
+    result.set(ephemeralKeyPair.publicKey, 0);
+    result.set(nonce, ephemeralKeyPair.publicKey.length);
+    result.set(encrypted, ephemeralKeyPair.publicKey.length + nonce.length);
+
+    return result;
+}
+
+export function decryptBox(encryptedBundle: Uint8Array, recipientSecretKey: Uint8Array): Uint8Array | null {
+    // Extract components from bundle: ephemeral public key (32 bytes) + nonce (24 bytes) + encrypted data
+    const ephemeralPublicKey = encryptedBundle.slice(0, sodium.crypto_box_PUBLICKEYBYTES);
+    const nonce = encryptedBundle.slice(sodium.crypto_box_PUBLICKEYBYTES, sodium.crypto_box_PUBLICKEYBYTES + sodium.crypto_box_NONCEBYTES);
+    const encrypted = encryptedBundle.slice(sodium.crypto_box_PUBLICKEYBYTES + sodium.crypto_box_NONCEBYTES);
+
+    try {
+        const decrypted = sodium.crypto_box_open_easy(encrypted, nonce, ephemeralPublicKey, recipientSecretKey);
+        return decrypted;
+    } catch (error) {
+        return null;
+    }
+}
+
+export function encryptSecretBox(data: any, secret: Uint8Array): Uint8Array {
+    const nonce = getRandomBytes(sodium.crypto_secretbox_NONCEBYTES);
+    const encrypted = sodium.crypto_secretbox_easy(new TextEncoder().encode(JSON.stringify(data)), nonce, secret);
+    const result = new Uint8Array(nonce.length + encrypted.length);
+    result.set(nonce);
+    result.set(encrypted, nonce.length);
+    return result;
+}
+
+export function decryptSecretBox(data: Uint8Array, secret: Uint8Array): any | null {
+    const nonce = data.slice(0, sodium.crypto_secretbox_NONCEBYTES);
+    const encrypted = data.slice(sodium.crypto_secretbox_NONCEBYTES);
+
+    try {
+        const decrypted = sodium.crypto_secretbox_open_easy(encrypted, nonce, secret);
+        if (!decrypted) {
+            return null;
+        }
+        return JSON.parse(new TextDecoder().decode(decrypted));
+    } catch (error) {
+        return null;
+    }
+}

package/sources/encryption/text.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect } from 'vitest';
+import { encodeUTF8, decodeUTF8, normalizeNFKD } from './text';
+
+describe('Text utilities', () => {
+    describe('encodeUTF8', () => {
+        it('should encode ASCII string correctly', () => {
+            const input = 'Hello, World!';
+            const expected = new Uint8Array([72, 101, 108, 108, 111, 44, 32, 87, 111, 114, 108, 100, 33]);
+            expect(encodeUTF8(input)).toEqual(expected);
+        });
+
+        it('should encode Unicode string correctly', () => {
+            const input = 'Hello, 世界!';
+            const expected = new Uint8Array([72, 101, 108, 108, 111, 44, 32, 228, 184, 150, 231, 149, 140, 33]);
+            expect(encodeUTF8(input)).toEqual(expected);
+        });
+    });
+
+    describe('decodeUTF8', () => {
+        it('should decode ASCII bytes correctly', () => {
+            const input = new Uint8Array([72, 101, 108, 108, 111, 44, 32, 87, 111, 114, 108, 100, 33]);
+            const expected = 'Hello, World!';
+            expect(decodeUTF8(input)).toBe(expected);
+        });
+
+        it('should decode Unicode bytes correctly', () => {
+            const input = new Uint8Array([72, 101, 108, 108, 111, 44, 32, 228, 184, 150, 231, 149, 140, 33]);
+            const expected = 'Hello, 世界!';
+            expect(decodeUTF8(input)).toBe(expected);
+        });
+    });
+
+    describe('normalizeNFKD', () => {
+        it('should normalize ligatures', () => {
+            expect(normalizeNFKD('fi')).toBe('fi');
+            expect(normalizeNFKD('ff')).toBe('ff');
+            expect(normalizeNFKD('ffl')).toBe('ffl');
+        });
+
+        it('should normalize accented characters', () => {
+            expect(normalizeNFKD('é')).toBe('e\u0301');
+            expect(normalizeNFKD('ñ')).toBe('n\u0303');
+        });
+
+        it('should normalize compatibility characters', () => {
+            expect(normalizeNFKD('①')).toBe('1');
+            expect(normalizeNFKD('㈱')).toBe('(株)');
+        });
+
+        it('should handle multiple normalizations in one string', () => {
+            const input = 'first ① éñd';
+            const expected = 'first 1 e\u0301n\u0303d';
+            expect(normalizeNFKD(input)).toBe(expected);
+        });
+
+        it('should return unchanged string when no normalization needed', () => {
+            const input = 'Hello, World!';
+            expect(normalizeNFKD(input)).toBe(input);
+        });
+    });
+}); 

package/sources/encryption/text.ts

@@ -0,0 +1,11 @@
+export function encodeUTF8(value: string) {
+    return new TextEncoder().encode(value);
+}
+
+export function decodeUTF8(value: Uint8Array) {
+    return new TextDecoder().decode(value);
+}
+
+export function normalizeNFKD(value: string) {
+    return value.normalize('NFKD');
+}

package/sources/hooks/useAsyncCommand.ts

@@ -0,0 +1,25 @@
+import * as React from 'react';
+
+export function useAsyncCommand(command: () => Promise<void>) {
+    const [state, setState] = React.useState(false);
+    const stateRef = React.useRef(state);
+    const execute = async () => {
+
+        // Guard
+        if (stateRef.current) {
+            return;
+        }
+        stateRef.current = true;
+        setState(true);
+
+        // Execution
+        try {
+            await command();
+        } finally {
+            stateRef.current = false;
+            setState(false);
+        }
+    };
+
+    return [state, execute] as const;
+}

package/sources/hooks/useAttachmentImage.ts

@@ -0,0 +1,134 @@
+/**
+ * Loads, decrypts and exposes a chat attachment as a data URI for inline
+ * rendering in chat bubbles. Decrypted blobs are kept in a module-level LRU
+ * (max 50 entries) so scrolling back through the chat does not re-decrypt
+ * every image. In-flight requests are de-duplicated per ref.
+ */
+import * as React from 'react';
+import { sync } from '@/sync/sync';
+import { downloadEncryptedAttachment } from '@/sync/apiAttachments';
+import { decryptBlob } from '@/encryption/blob';
+import { encodeBase64 } from '@/encryption/base64';
+
+const MAX_CACHE_ENTRIES = 50;
+const cache = new Map<string, string>();
+const inFlight = new Map<string, Promise<string | null>>();
+
+function rememberInCache(ref: string, dataUri: string) {
+    if (cache.has(ref)) cache.delete(ref);
+    cache.set(ref, dataUri);
+    while (cache.size > MAX_CACHE_ENTRIES) {
+        const oldest = cache.keys().next().value;
+        if (oldest === undefined) break;
+        cache.delete(oldest);
+    }
+}
+
+function detectImageMime(bytes: Uint8Array): string {
+    if (bytes.length >= 4 && bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4E && bytes[3] === 0x47) {
+        return 'image/png';
+    }
+    if (bytes.length >= 3 && bytes[0] === 0xFF && bytes[1] === 0xD8 && bytes[2] === 0xFF) {
+        return 'image/jpeg';
+    }
+    if (bytes.length >= 4 && bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38) {
+        return 'image/gif';
+    }
+    if (
+        bytes.length >= 12 &&
+        bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46 &&
+        bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50
+    ) {
+        return 'image/webp';
+    }
+    return 'image/png';
+}
+
+async function loadAttachmentDataUri(sessionId: string, ref: string): Promise<string | null> {
+    const credentials = sync.getCredentials();
+    if (!credentials) {
+        console.warn(`[attachment-image] no credentials for ${ref}`);
+        return null;
+    }
+    const blobKey = sync.encryption.getSessionBlobKey(sessionId);
+    if (!blobKey) {
+        console.warn(`[attachment-image] no blobKey for session ${sessionId} (ref=${ref})`);
+        return null;
+    }
+    if (blobKey.length !== 32) {
+        console.warn(`[attachment-image] blobKey wrong length: ${blobKey.length} (ref=${ref})`);
+        return null;
+    }
+    let encrypted: Uint8Array;
+    try {
+        encrypted = await downloadEncryptedAttachment(credentials, sessionId, ref);
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn(`[attachment-image] download failed for ${ref}: ${message}`);
+        return null;
+    }
+    const decrypted = decryptBlob(encrypted, blobKey);
+    if (!decrypted) {
+        console.warn(`[attachment-image] decrypt returned null for ${ref} (encrypted.length=${encrypted.length})`);
+        return null;
+    }
+    const mime = detectImageMime(decrypted);
+    return `data:${mime};base64,${encodeBase64(decrypted)}`;
+}
+
+export type AttachmentImageState = {
+    uri: string | null;
+    loading: boolean;
+    error: string | null;
+};
+
+export function useAttachmentImage(sessionId: string, ref: string | undefined): AttachmentImageState {
+    const [state, setState] = React.useState<AttachmentImageState>(() => {
+        if (!ref) return { uri: null, loading: false, error: null };
+        const cached = cache.get(ref);
+        return cached
+            ? { uri: cached, loading: false, error: null }
+            : { uri: null, loading: true, error: null };
+    });
+
+    React.useEffect(() => {
+        if (!ref) {
+            setState({ uri: null, loading: false, error: null });
+            return;
+        }
+        const cached = cache.get(ref);
+        if (cached) {
+            cache.delete(ref);
+            cache.set(ref, cached);
+            setState({ uri: cached, loading: false, error: null });
+            return;
+        }
+        let cancelled = false;
+        setState({ uri: null, loading: true, error: null });
+
+        let promise = inFlight.get(ref);
+        if (!promise) {
+            promise = loadAttachmentDataUri(sessionId, ref)
+                .finally(() => { inFlight.delete(ref); });
+            inFlight.set(ref, promise);
+        }
+
+        promise.then((uri) => {
+            if (cancelled) return;
+            if (uri) {
+                rememberInCache(ref, uri);
+                setState({ uri, loading: false, error: null });
+            } else {
+                setState({ uri: null, loading: false, error: 'decrypt_failed' });
+            }
+        }).catch((err) => {
+            if (cancelled) return;
+            const message = err instanceof Error ? err.message : 'unknown';
+            setState({ uri: null, loading: false, error: message });
+        });
+
+        return () => { cancelled = true; };
+    }, [sessionId, ref]);
+
+    return state;
+}

package/sources/hooks/useAutocomplete.ts

@@ -0,0 +1,69 @@
+import * as React from 'react';
+import { InvalidateSync } from '@/utils/sync';
+
+// Types
+export interface AutocompleteResult {
+    text: string;
+}
+
+export interface UseAutocompleteOptions {
+    text: string;
+    cursorPosition: number;
+    autocompleteFunction: (text: string, cursorPosition: number) => Promise<AutocompleteResult[]>;
+    debounceMs?: number;
+}
+
+export interface UseAutocompleteReturn {
+    results: AutocompleteResult[];
+    isLoading: boolean;
+}
+
+const emptyArray: AutocompleteResult[] = [];
+
+export function useAutocomplete(query: string | null, resolver: (text: string) => Promise<AutocompleteResult[]>) {
+
+    const [results, setResults] = React.useState<AutocompleteResult[]>([]);
+
+    const sync = React.useMemo(() => {
+
+        const state = { query };
+        let cache = new Map<string, AutocompleteResult[]>();
+
+        let sync = new InvalidateSync(async () => {
+            let t = state.query;
+            if (t === null) {
+                setResults(emptyArray);
+                return;
+            }
+            let results = cache.get(t);
+            if (results === undefined) {
+                results = await resolver(t);
+                cache.set(t, results);
+            }
+            if (state.query === t) {
+                setResults(results);
+            }
+        });
+
+        return {
+            sync,
+            state,
+            onSearchQueryChange: (text: string | null) => {
+                state.query = text;
+                sync.invalidate();
+            },
+        };
+    }, []);
+
+    // Trigger sync
+    React.useEffect(() => {
+        sync.onSearchQueryChange(query);
+    }, [query]);
+
+    // Return empty array if no query
+    if (query === null) {
+        return emptyArray;
+    } else {
+        return results;
+    }
+}

package/sources/hooks/useAutocompleteSession.ts

@@ -0,0 +1,53 @@
+import * as React from 'react';
+import { useAutocomplete } from "./useAutocomplete";
+
+/**
+ * Extracts @ mention token from text at cursor position
+ * Returns the token if found, null otherwise
+ */
+function extractMentionToken(text: string, cursorPosition: number): string | null {
+    if (!text) return null;
+
+    // Get text up to cursor position
+    const textBeforeCursor = text.substring(0, cursorPosition);
+
+    // Regex pattern to match @ mentions
+    // Matches @[alphanumeric_-./\]* at the end of the string
+    const mentionRegex = /@[a-zA-Z0-9_\-./\\]*$/;
+
+    const match = textBeforeCursor.match(mentionRegex);
+    if (!match || match.index === undefined) return null;
+
+    // Return just the token (e.g., "@src/app")
+    return match[0];
+}
+
+// Checks if text starts with a slash command
+function extractSlashCommandToken(text: string, cursorPosition: number): string | null {
+    if (text.startsWith('/')) {
+        return text.substring(0, cursorPosition);
+    }
+    return null;
+}
+
+export function useAutocompleteSession(text: string, cursorPosition: number) {
+    const query = React.useMemo(() => {
+        const slashCommand = extractSlashCommandToken(text, cursorPosition);
+        if (slashCommand !== null) {
+            return slashCommand;
+        }
+        const mention = extractMentionToken(text, cursorPosition);
+        if (mention !== null) {
+            return mention;
+        }
+        return null;
+    }, [text, cursorPosition]);
+    return useAutocomplete(query, async (q) => {
+        if (q.startsWith('/')) {
+            if ('/compact'.startsWith(q.toLowerCase())) {
+                return [{ text: '/compact' }];
+            }
+        }
+        return [];
+    });
+}

package/sources/hooks/useChangelog.ts

@@ -0,0 +1,45 @@
+import { useState, useCallback } from 'react';
+import { MMKV } from 'react-native-mmkv';
+import {
+    getLastViewedTitle,
+    setLastViewedTitle,
+    getLatestTitle
+} from '@/changelog';
+
+const mmkv = new MMKV();
+
+export function useChangelog() {
+    const latestTitle = getLatestTitle();
+
+    const [hasUnread, setHasUnread] = useState(() => {
+        const lastViewed = getLastViewedTitle();
+
+        // On first install (no old or new key), mark as read
+        // If old version key exists but new title key doesn't, this is a
+        // migration — show the banner
+        if (!lastViewed && latestTitle) {
+            const hadOldKey = mmkv.contains('changelog-last-viewed-version');
+            if (!hadOldKey) {
+                setLastViewedTitle(latestTitle);
+                return false;
+            }
+            // Migration from old system — treat as unread
+            return true;
+        }
+
+        return latestTitle !== lastViewed;
+    });
+
+    const markAsRead = useCallback(() => {
+        if (latestTitle) {
+            setLastViewedTitle(latestTitle);
+            setHasUnread(false);
+        }
+    }, [latestTitle]);
+
+    return {
+        hasUnread,
+        latestTitle,
+        markAsRead
+    };
+}

package/sources/hooks/useCheckCameraPermissions.ts

@@ -0,0 +1,25 @@
+import { useCameraPermissions } from "expo-camera";
+import { Platform } from "react-native";
+
+export function useCheckScannerPermissions(): () => Promise<boolean> {
+    const [cameraPermission, requestCameraPermission] = useCameraPermissions();
+
+    return async () => {
+        if (Platform.OS === 'android') {
+            // adroid uses google code scanner which doesn't need permissions
+            return true;
+        }
+
+        if (!cameraPermission) {
+            // camera permissions are loading
+            return false;
+        }
+
+        if (!cameraPermission.granted) {
+            const reqRes = await requestCameraPermission();
+            return reqRes.granted;
+        }
+
+        return true;
+    }
+}

package/sources/hooks/useConnectAccount.ts

@@ -0,0 +1,107 @@
+import * as React from 'react';
+import { Platform } from 'react-native';
+import { CameraView } from 'expo-camera';
+import { useAuth } from '@/auth/AuthContext';
+import { decodeBase64 } from '@/encryption/base64';
+import { encryptBox } from '@/encryption/libsodium';
+import { authAccountApprove } from '@/auth/authAccountApprove';
+import { useCheckScannerPermissions } from '@/hooks/useCheckCameraPermissions';
+import { Modal } from '@/modal';
+import { t } from '@/text';
+
+interface UseConnectAccountOptions {
+    onSuccess?: () => void;
+    onError?: (error: any) => void;
+}
+
+export function useConnectAccount(options?: UseConnectAccountOptions) {
+    const auth = useAuth();
+    const [isLoading, setIsLoading] = React.useState(false);
+    const checkScannerPermissions = useCheckScannerPermissions();
+
+    const processAuthUrl = React.useCallback(async (url: string) => {
+        if (!url.startsWith('nastech:///account?')) {
+            Modal.alert(t('common.error'), t('modals.invalidAuthUrl'), [{ text: t('common.ok') }]);
+            return false;
+        }
+        
+        setIsLoading(true);
+        try {
+            const tail = url.slice('nastech:///account?'.length);
+            const publicKey = decodeBase64(tail, 'base64url');
+            const response = encryptBox(decodeBase64(auth.credentials!.secret, 'base64url'), publicKey);
+            await authAccountApprove(auth.credentials!.token, publicKey, response);
+            
+            Modal.alert(t('common.success'), t('modals.deviceLinkedSuccessfully'), [
+                { 
+                    text: t('common.ok'), 
+                    onPress: () => options?.onSuccess?.()
+                }
+            ]);
+            return true;
+        } catch (e) {
+            console.error(e);
+            Modal.alert(t('common.error'), t('modals.failedToLinkDevice'), [{ text: t('common.ok') }]);
+            options?.onError?.(e);
+            return false;
+        } finally {
+            setIsLoading(false);
+        }
+    }, [auth.credentials, options]);
+
+    const connectAccount = React.useCallback(async () => {
+        if (await checkScannerPermissions()) {
+            // Use camera scanner
+            CameraView.launchScanner({
+                barcodeTypes: ['qr']
+            });
+        } else {
+            Modal.alert(t('common.error'), t('modals.cameraPermissionsRequiredToScanQr'), [{ text: t('common.ok') }]);
+        }
+    }, [checkScannerPermissions]);
+
+    const connectWithUrl = React.useCallback(async (url: string) => {
+        return await processAuthUrl(url);
+    }, [processAuthUrl]);
+
+    // Set up barcode scanner listener
+    const isProcessingRef = React.useRef(false);
+    React.useEffect(() => {
+        if (CameraView.isModernBarcodeScannerAvailable) {
+            const subscription = CameraView.onModernBarcodeScanned(async (event) => {
+                if (isProcessingRef.current) return;
+                if (event.data.startsWith('nastech:///account?')) {
+                    isProcessingRef.current = true;
+                    try {
+                        if (Platform.OS === 'ios') {
+                            try {
+                                await CameraView.dismissScanner();
+                            } catch (e) {
+                                console.warn('Failed to dismiss scanner', e);
+                            }
+                        }
+                        await processAuthUrl(event.data);
+                    } finally {
+                        isProcessingRef.current = false;
+                    }
+                }
+            });
+            return () => {
+                subscription.remove();
+                isProcessingRef.current = false;
+                if (Platform.OS === 'ios') {
+                    CameraView.dismissScanner().catch((e: unknown) => {
+                        console.warn('Failed to dismiss scanner during cleanup', e);
+                    });
+                }
+            };
+        }
+    }, [processAuthUrl]);
+
+    return {
+        connectAccount,
+        connectWithUrl,
+        isLoading,
+        processAuthUrl
+    };
+}