nostr-double-ratchet 0.0.33 → 0.0.35

package/src/Invite.ts

@@ -220,10 +220,11 @@ export class Invite {
      * @param nostrSubscribe - A function to subscribe to Nostr events
      * @param inviteePublicKey - The invitee's public key
      * @param encryptor - The invitee's secret key or a signing/encrypt function
+     * @param deviceId - Optional device ID to identify the invitee's device
      * @returns An object containing the new session and an event to be published
      *
      * 1. Inner event: No signature, content encrypted with DH(inviter, invitee).
-     *    Purpose: Authenticate invitee. Contains invitee session key.
+     *    Purpose: Authenticate invitee. Contains invitee session key and deviceId.
      * 2. Envelope: No signature, content encrypted with DH(inviter, random key).
      *    Purpose: Contains inner event. Hides invitee from others who might have the shared Nostr key.
 
@@ -234,6 +235,7 @@ export class Invite {
         nostrSubscribe: NostrSubscribe,
         inviteePublicKey: string,
         encryptor: Uint8Array | EncryptFunction,
+        deviceId?: string,
     ): Promise<{ session: Session, event: VerifiedEvent }> {
         const inviteeSessionKey = generateSecretKey();
         const inviteeSessionPublicKey = getPublicKey(inviteeSessionKey);
@@ -248,7 +250,11 @@ export class Invite {
             encryptor :
             (plaintext: string, pubkey: string) => Promise.resolve(nip44.encrypt(plaintext, getConversationKey(encryptor, pubkey)));
 
-        const dhEncrypted = await encrypt(inviteeSessionPublicKey, inviterPublicKey);
+        const payload = JSON.stringify({
+            sessionKey: inviteeSessionPublicKey,
+            deviceId: deviceId
+        });
+        const dhEncrypted = await encrypt(payload, inviterPublicKey);
 
         const innerEvent = {
             pubkey: inviteePublicKey,
@@ -272,7 +278,7 @@ export class Invite {
         return { session, event: finalizeEvent(envelope, randomSenderKey) };
     }
 
-    listen(decryptor: Uint8Array | DecryptFunction, nostrSubscribe: NostrSubscribe, onSession: (_session: Session, _identity?: string) => void): Unsubscribe {
+    listen(decryptor: Uint8Array | DecryptFunction, nostrSubscribe: NostrSubscribe, onSession: (_session: Session, _identity: string, _deviceId?: string) => void): Unsubscribe {
         if (!this.inviterEphemeralPrivateKey) {
             throw new Error("Inviter session key is not available");
         }
@@ -304,12 +310,23 @@ export class Invite {
                     decryptor :
                     (ciphertext: string, pubkey: string) => Promise.resolve(nip44.decrypt(ciphertext, getConversationKey(decryptor, pubkey)));
 
-                const inviteeSessionPublicKey = await innerDecrypt(dhEncrypted, inviteeIdentity);
+                const decryptedPayload = await innerDecrypt(dhEncrypted, inviteeIdentity);
+
+                let inviteeSessionPublicKey: string;
+                let deviceId: string | undefined;
+
+                try {
+                    const parsed = JSON.parse(decryptedPayload);
+                    inviteeSessionPublicKey = parsed.sessionKey;
+                    deviceId = parsed.deviceId;
+                } catch {
+                    inviteeSessionPublicKey = decryptedPayload;
+                }
 
                 const name = event.id;
                 const session = Session.init(nostrSubscribe, inviteeSessionPublicKey, this.inviterEphemeralPrivateKey!, false, sharedSecret, name);
 
-                onSession(session, inviteeIdentity);
+                onSession(session, inviteeIdentity, deviceId);
             } catch {
             }
         });

package/src/Session.ts

@@ -10,7 +10,7 @@ import {
   Rumor,
   CHAT_MESSAGE_KIND,
 } from "./types";
-import { kdf } from "./utils";
+import { kdf, deepCopyState } from "./utils";
 
 const MAX_SKIP = 1000;
 
@@ -319,47 +319,64 @@ export class Session {
     throw new Error("Failed to decrypt header with current and skipped header keys");
   }
 
+
   private handleNostrEvent(e: { tags: string[][]; pubkey: string; content: string }) {
+    const snapshot = deepCopyState(this.state);
+    let pendingSwitch = false;
+
     try {
       const [header, shouldRatchet, isSkipped] = this.decryptHeader(e);
+      if (!isSkipped && this.state.theirNextNostrPublicKey !== header.nextPublicKey) {
+        this.state.theirCurrentNostrPublicKey = this.state.theirNextNostrPublicKey;
+        this.state.theirNextNostrPublicKey = header.nextPublicKey;
+        pendingSwitch = true;
+      }
 
       if (!isSkipped) {
-        if (this.state.theirNextNostrPublicKey !== header.nextPublicKey) {
-          this.state.theirCurrentNostrPublicKey = this.state.theirNextNostrPublicKey;
-          this.state.theirNextNostrPublicKey = header.nextPublicKey;
-          this.nostrUnsubscribe?.();
-          this.nostrUnsubscribe = this.nostrNextUnsubscribe;
-          this.nostrNextUnsubscribe = this.nostrSubscribe(
-            {authors: [this.state.theirNextNostrPublicKey], kinds: [MESSAGE_EVENT_KIND]},
-            (e) => this.handleNostrEvent(e)
-          );
-        }
-    
         if (shouldRatchet) {
           this.skipMessageKeys(header.previousChainLength, e.pubkey);
           this.ratchetStep();
         }
       } else {
         if (!this.state.skippedKeys[e.pubkey]?.messageKeys[header.number]) {
-          // Maybe we already processed this message — no error
-          return
+          return;
         }
       }
 
       const text = this.ratchetDecrypt(header, e.content, e.pubkey);
       const innerEvent = JSON.parse(text);
+
       if (!validateEvent(innerEvent)) {
+        this.state = snapshot;
         return;
       }
-
       if (innerEvent.id !== getEventHash(innerEvent)) {
+        this.state = snapshot;
         return;
       }
 
-      this.internalSubscriptions.forEach(callback => callback(innerEvent, e as VerifiedEvent));  
+      if (pendingSwitch) {
+        this.nostrUnsubscribe?.();
+        this.nostrUnsubscribe = this.nostrNextUnsubscribe;
+        this.nostrNextUnsubscribe = this.nostrSubscribe(
+          { authors: [this.state.theirNextNostrPublicKey], kinds: [MESSAGE_EVENT_KIND] },
+          (ev) => this.handleNostrEvent(ev)
+        );
+      }
+
+      this.internalSubscriptions.forEach(callback => callback(innerEvent, e as VerifiedEvent));
     } catch (error) {
-      if (error instanceof Error && error.message.includes("Failed to decrypt header")) {
-        return;
+      this.state = snapshot;
+      if (error instanceof Error) {
+        if (error.message.includes("Failed to decrypt header")) {
+          return;
+        }
+
+        if (error.message === "invalid MAC") {
+          // Duplicate or stale ciphertexts can hit decrypt() again after a state restore.
+          // nip44 throws "invalid MAC" in that case, but the message has already been handled.
+          return;
+        }
       }
       throw error;
     }

package/src/utils.ts

@@ -115,6 +115,41 @@ export function deserializeSessionState(data: string): SessionState {
   };
 }
 
+export function deepCopyState(s: SessionState): SessionState {
+  return {
+    rootKey: new Uint8Array(s.rootKey),
+    theirCurrentNostrPublicKey: s.theirCurrentNostrPublicKey,
+    theirNextNostrPublicKey: s.theirNextNostrPublicKey,
+    ourCurrentNostrKey: s.ourCurrentNostrKey
+      ? {
+          publicKey: s.ourCurrentNostrKey.publicKey,
+          privateKey: new Uint8Array(s.ourCurrentNostrKey.privateKey),
+        }
+      : undefined,
+    ourNextNostrKey: {
+      publicKey: s.ourNextNostrKey.publicKey,
+      privateKey: new Uint8Array(s.ourNextNostrKey.privateKey),
+    },
+    receivingChainKey: s.receivingChainKey ? new Uint8Array(s.receivingChainKey) : undefined,
+    sendingChainKey: s.sendingChainKey ? new Uint8Array(s.sendingChainKey) : undefined,
+    sendingChainMessageNumber: s.sendingChainMessageNumber,
+    receivingChainMessageNumber: s.receivingChainMessageNumber,
+    previousSendingChainMessageCount: s.previousSendingChainMessageCount,
+    skippedKeys: Object.fromEntries(
+      Object.entries(s.skippedKeys).map(([author, entry]: any) => [
+        author,
+        {
+          headerKeys: entry.headerKeys.map((hk: Uint8Array) => new Uint8Array(hk)),
+          messageKeys: Object.fromEntries(
+            Object.entries(entry.messageKeys).map(([n, mk]: any) => [n, new Uint8Array(mk)])
+          ),
+        },
+      ])
+    ),
+  };
+}
+
+
 export async function* createEventStream(session: Session): AsyncGenerator<Rumor, void, unknown> {
   const messageQueue: Rumor[] = [];
   let resolveNext: ((_value: Rumor) => void) | null = null;