zapo-js 0.1.2 → 0.3.0

package/dist/esm/signal/registration/utils.js

@@ -1,13 +1,14 @@
 import { generatePreKeyPair, generateRegistrationInfo, generateSignedPreKey } from '../registration/keygen.js';
-export async function createAndStoreInitialKeys(store) {
+export async function createAndStoreInitialKeys(store, preKeyStore) {
     const [registrationInfo, firstPreKey] = await Promise.all([
         generateRegistrationInfo(),
         generatePreKeyPair(1)
     ]);
     const signedPreKey = await generateSignedPreKey(1, registrationInfo.identityKeyPair.privKey);
+    // Keep writes ordered so partial commit failures don't leave split registration bootstrap state.
     await store.setRegistrationInfo(registrationInfo);
     await store.setSignedPreKey(signedPreKey);
-    await store.getOrGenSinglePreKey(async () => firstPreKey);
+    await preKeyStore.getOrGenSinglePreKey(async () => firstPreKey);
     return {
         registrationInfo,
         signedPreKey,

package/dist/esm/signal/session/SignalProtocol.js

@@ -1,6 +1,8 @@
 import { toSerializedPubKey } from '../../crypto/index.js';
 import { ConsoleLogger } from '../../infra/log/ConsoleLogger.js';
+import { StoreLock } from '../../infra/perf/StoreLock.js';
 import { MAX_PREV_SESSIONS } from '../constants.js';
+import { encodeSignalSessionSnapshot } from '../encoding.js';
 import { decryptMsg, decryptMsgFromSession, encryptMsg } from '../session/SignalRatchet.js';
 import { deserializeMsg, deserializePkMsg, requirePreKey, requireSignedPreKey } from '../session/SignalSerializer.js';
 import { detachSession, findMatchingSession, generateSerializedKeyPair, initiateSessionIncoming, initiateSessionOutgoing, requireLocalIdentity, toSerializedKeyPair } from '../session/SignalSession.js';
@@ -8,26 +10,37 @@ import { uint8Equal } from '../../util/bytes.js';
 function signalAddressMapKey(address) {
     return `${address.user}\u0001${address.server ?? ''}\u0001${address.device}`;
 }
+function signalAddressLockKey(address) {
+    return `signal:${signalAddressMapKey(address)}`;
+}
 export class SignalProtocol {
-    constructor(store, logger = new ConsoleLogger('info')) {
-        this.store = store;
+    constructor(stores, logger = new ConsoleLogger('info')) {
+        this.stores = stores;
         this.logger = logger;
+        this.sessionMutationLock = new StoreLock();
     }
-    async hasSession(address) {
-        return this.store.hasSession(address);
-    }
-    async hasSessions(addresses) {
-        return this.store.hasSessions(addresses);
-    }
-    async establishOutgoingSession(address, remoteBundle) {
-        const [local, localOneTimeBase] = await Promise.all([
-            requireLocalIdentity(this.store),
-            generateSerializedKeyPair()
-        ]);
-        const session = await initiateSessionOutgoing(local, remoteBundle, localOneTimeBase);
-        await this.store.setRemoteIdentity(address, session.remote.pubKey);
-        await this.store.setSession(address, session);
-        return session;
+    async establishOutgoingSession(address, remoteBundle, options = {}) {
+        return this.runWithAddressLock(address, async () => {
+            if (options.reuseExisting) {
+                const existing = await this.stores.session.getSession(address);
+                if (existing) {
+                    const remoteIdentity = toSerializedPubKey(remoteBundle.identity);
+                    if (!uint8Equal(existing.remote.pubKey, remoteIdentity)) {
+                        throw new Error('identity mismatch');
+                    }
+                    return existing;
+                }
+            }
+            const [local, localOneTimeBase] = await Promise.all([
+                requireLocalIdentity(this.stores.signal),
+                generateSerializedKeyPair()
+            ]);
+            const session = await initiateSessionOutgoing(local, remoteBundle, localOneTimeBase);
+            // Keep writes ordered: a stored session without matching remote identity causes false mismatch checks.
+            await this.stores.identity.setRemoteIdentity(address, session.remote.pubKey);
+            await this.stores.session.setSession(address, session);
+            return session;
+        });
     }
     async encryptMessage(address, plaintext, expectedIdentity) {
         const [encrypted] = await this.encryptMessagesBatch([
@@ -35,77 +48,140 @@ export class SignalProtocol {
         ]);
         return encrypted;
     }
-    async encryptMessagesBatch(requests) {
+    async encryptMessagesBatch(requests, prefetchedSessions) {
         if (requests.length === 0) {
             return [];
         }
-        const addresses = requests.map((request) => request.address);
-        const storedSessions = await this.store.getSessionsBatch(addresses);
-        const latestSessionByAddress = new Map();
-        const sessionUpdatesByAddress = new Map();
-        const identityUpdatesByAddress = new Map();
-        const results = new Array(requests.length);
-        for (let index = 0; index < requests.length; index += 1) {
-            const request = requests[index];
-            const address = request.address;
-            const addressKey = signalAddressMapKey(address);
-            const session = latestSessionByAddress.get(addressKey) ?? storedSessions[index];
-            if (!session) {
-                throw new Error('signal session not found');
+        const lockKeySet = new Set();
+        for (let i = 0; i < requests.length; i += 1)
+            lockKeySet.add(signalAddressLockKey(requests[i].address));
+        const lockKeys = [...lockKeySet];
+        return this.sessionMutationLock.runMany(lockKeys, async () => {
+            const prefetchedByAddress = new Map();
+            if (prefetchedSessions && prefetchedSessions.length > 0) {
+                for (let index = 0; index < prefetchedSessions.length; index += 1) {
+                    const entry = prefetchedSessions[index];
+                    prefetchedByAddress.set(signalAddressMapKey(entry.address), entry.session);
+                }
             }
-            if (request.expectedIdentity &&
-                !uint8Equal(toSerializedPubKey(request.expectedIdentity), session.remote.pubKey)) {
-                throw new Error('identity mismatch');
+            const uniqueAddressKeys = new Array(requests.length);
+            const uniqueAddresses = new Array(requests.length);
+            let uniqueAddressCount = 0;
+            for (let index = 0; index < requests.length; index += 1) {
+                const address = requests[index].address;
+                const addressKey = signalAddressMapKey(address);
+                let isDuplicate = false;
+                for (let dedupIndex = 0; dedupIndex < uniqueAddressCount; dedupIndex += 1) {
+                    if (uniqueAddressKeys[dedupIndex] === addressKey) {
+                        isDuplicate = true;
+                        break;
+                    }
+                }
+                if (isDuplicate) {
+                    continue;
+                }
+                uniqueAddressKeys[uniqueAddressCount] = addressKey;
+                uniqueAddresses[uniqueAddressCount] = address;
+                uniqueAddressCount += 1;
             }
-            const [updatedSession, encrypted] = await encryptMsg(session, request.plaintext);
-            latestSessionByAddress.set(addressKey, updatedSession);
-            sessionUpdatesByAddress.set(addressKey, {
-                address,
-                session: updatedSession
-            });
-            if (!uint8Equal(updatedSession.remote.pubKey, session.remote.pubKey)) {
-                identityUpdatesByAddress.set(addressKey, {
+            uniqueAddressKeys.length = uniqueAddressCount;
+            uniqueAddresses.length = uniqueAddressCount;
+            const currentSessions = await this.stores.session.getSessionsBatch(uniqueAddresses);
+            const latestSessionByAddress = new Map();
+            for (let index = 0; index < uniqueAddressCount; index += 1) {
+                const addressKey = uniqueAddressKeys[index];
+                const current = currentSessions[index];
+                if (current) {
+                    latestSessionByAddress.set(addressKey, current);
+                    continue;
+                }
+                const prefetched = prefetchedByAddress.get(addressKey);
+                if (prefetched) {
+                    latestSessionByAddress.set(addressKey, prefetched);
+                }
+            }
+            const sessionUpdatesByAddress = new Map();
+            const identityUpdatesByAddress = new Map();
+            const results = new Array(requests.length);
+            for (let index = 0; index < requests.length; index += 1) {
+                const request = requests[index];
+                const address = request.address;
+                const addressKey = signalAddressMapKey(address);
+                const session = latestSessionByAddress.get(addressKey);
+                if (!session) {
+                    throw new Error('signal session not found');
+                }
+                if (request.expectedIdentity &&
+                    !uint8Equal(toSerializedPubKey(request.expectedIdentity), session.remote.pubKey)) {
+                    throw new Error('identity mismatch');
+                }
+                const [updatedSession, encrypted] = await encryptMsg(session, request.plaintext);
+                latestSessionByAddress.set(addressKey, updatedSession);
+                sessionUpdatesByAddress.set(addressKey, {
                     address,
-                    identityKey: updatedSession.remote.pubKey
+                    session: updatedSession
                 });
+                if (!uint8Equal(updatedSession.remote.pubKey, session.remote.pubKey)) {
+                    identityUpdatesByAddress.set(addressKey, {
+                        address,
+                        identityKey: updatedSession.remote.pubKey
+                    });
+                }
+                results[index] = {
+                    ...encrypted,
+                    baseKey: updatedSession.aliceBaseKey
+                };
             }
-            results[index] = {
-                ...encrypted,
-                baseKey: updatedSession.aliceBaseKey
-            };
-        }
-        await this.store.setSessionsBatch([...sessionUpdatesByAddress.values()]);
-        if (identityUpdatesByAddress.size > 0) {
-            await this.store.setRemoteIdentities([...identityUpdatesByAddress.values()]);
-        }
-        return results;
+            // Persist remote identities first when needed so session writes never commit ahead of identity data.
+            if (identityUpdatesByAddress.size > 0) {
+                const identityUpdates = new Array(identityUpdatesByAddress.size);
+                let identityIndex = 0;
+                for (const update of identityUpdatesByAddress.values()) {
+                    identityUpdates[identityIndex] = update;
+                    identityIndex += 1;
+                }
+                await this.stores.identity.setRemoteIdentities(identityUpdates);
+            }
+            const sessionUpdates = new Array(sessionUpdatesByAddress.size);
+            let sessionIndex = 0;
+            for (const update of sessionUpdatesByAddress.values()) {
+                sessionUpdates[sessionIndex] = update;
+                sessionIndex += 1;
+            }
+            await this.stores.session.setSessionsBatch(sessionUpdates);
+            return results;
+        });
     }
     async decryptMessage(address, envelope) {
-        const currentSession = await this.store.getSession(address);
-        let outcome;
-        if (envelope.type === 'pkmsg') {
-            const parsedPk = deserializePkMsg(envelope.ciphertext);
-            outcome = await this.decryptPkMsg(currentSession, parsedPk);
-        }
-        else {
-            const parsed = deserializeMsg(envelope.ciphertext);
-            outcome = await this.decryptMsgInternal(currentSession, parsed);
-        }
-        const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
-        if (!currentSession || !uint8Equal(currentSession.remote.pubKey, nextRemoteIdentity)) {
-            await this.store.setRemoteIdentity(address, nextRemoteIdentity);
-        }
-        await this.store.setSession(address, outcome.updatedSession);
-        return outcome.plaintext;
-    }
-    async decryptMsgInternal(session, parsed) {
-        return decryptMsg(session, parsed, (error, previousSessionIndex) => {
-            this.logger.debug('signal decrypt fallback session failed', {
-                previousSessionIndex,
-                message: error.message
-            });
+        return this.runWithAddressLock(address, async () => {
+            const currentSession = await this.stores.session.getSession(address);
+            let outcome;
+            if (envelope.type === 'pkmsg') {
+                const parsedPk = deserializePkMsg(envelope.ciphertext);
+                outcome = await this.decryptPkMsg(currentSession, parsedPk);
+            }
+            else {
+                const parsed = deserializeMsg(envelope.ciphertext);
+                outcome = await decryptMsg(currentSession, parsed, (error, previousSessionIndex) => {
+                    this.logger.debug('signal decrypt fallback session failed', {
+                        previousSessionIndex,
+                        message: error.message
+                    });
+                });
+            }
+            const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
+            const identityChanged = !currentSession || !uint8Equal(currentSession.remote.pubKey, nextRemoteIdentity);
+            // Keep writes ordered for consistency with resolver identity checks.
+            if (identityChanged) {
+                await this.stores.identity.setRemoteIdentity(address, nextRemoteIdentity);
+            }
+            await this.stores.session.setSession(address, outcome.updatedSession);
+            return outcome.plaintext;
         });
     }
+    runWithAddressLock(address, task) {
+        return this.sessionMutationLock.run(signalAddressLockKey(address), task);
+    }
     async decryptPkMsg(currentSession, parsed) {
         const matchingSession = findMatchingSession(currentSession, parsed.sessionBaseKey);
         if (matchingSession) {
@@ -117,11 +193,11 @@ export class SignalProtocol {
             };
         }
         const [local, signedPreKey, oneTimePreKey] = await Promise.all([
-            requireLocalIdentity(this.store),
-            requireSignedPreKey(this.store, parsed.localSignedPreKeyId),
+            requireLocalIdentity(this.stores.signal),
+            requireSignedPreKey(this.stores.signal, parsed.localSignedPreKeyId),
             parsed.localOneTimeKeyId === null || parsed.localOneTimeKeyId === undefined
                 ? Promise.resolve(null)
-                : requirePreKey(this.store, parsed.localOneTimeKeyId)
+                : requirePreKey(this.stores.preKey, parsed.localOneTimeKeyId)
         ]);
         const incoming = await initiateSessionIncoming(local, parsed.remote, parsed.sessionBaseKey, {
             signed: toSerializedKeyPair(signedPreKey.keyPair),
@@ -135,14 +211,15 @@ export class SignalProtocol {
             ? {
                 ...incoming,
                 prevSessions: [
-                    detachSession(currentSession),
+                    encodeSignalSessionSnapshot(detachSession(currentSession)),
                     ...currentSession.prevSessions.slice(0, MAX_PREV_SESSIONS - 1)
                 ]
             }
             : incoming;
         const [updatedSession, plaintext] = await decryptMsgFromSession(baseSession, parsed);
+        // Only consume one-time prekeys after successful decrypt/session materialization.
         if (parsed.localOneTimeKeyId !== null && parsed.localOneTimeKeyId !== undefined) {
-            await this.store.consumePreKeyById(parsed.localOneTimeKeyId);
+            await this.stores.preKey.consumePreKeyById(parsed.localOneTimeKeyId);
         }
         return {
             updatedSession,

package/dist/esm/signal/session/SignalRatchet.js

@@ -1,7 +1,8 @@
-import { aesCbcDecrypt, aesCbcEncrypt, hkdf, importAesCbcKey, importHmacKey, hmacSign, prependVersion, toSerializedPubKey } from '../../crypto/index.js';
+import { aesCbcDecrypt, aesCbcEncrypt, hkdf, hmacSign, importAesCbcKey, importHmacKey, prependVersion, toSerializedPubKey } from '../../crypto/index.js';
 import { proto } from '../../proto.js';
 import { CHAIN_KEY_LABEL, FUTURE_MESSAGES_MAX, MAX_UNUSED_KEYS, MESSAGE_KEY_LABEL, SIGNAL_MAC_SIZE, SIGNAL_VERSION } from '../constants.js';
-import { detachSession, calculateRatchet, generateSerializedKeyPair, snapshotToRecord } from '../session/SignalSession.js';
+import { decodeSignalMessageKey, decodeSignalRecvChain, decodeSignalSessionSnapshot, encodeSignalRecvChain, encodeSignalSessionSnapshot } from '../encoding.js';
+import { calculateRatchet, detachSession, generateSerializedKeyPair, snapshotToRecord } from '../session/SignalSession.js';
 import { concatBytes, removeAt, uint8Equal } from '../../util/bytes.js';
 import { toError } from '../../util/primitives.js';
 const MAX_TRACKED_RECV_CHAINS = 4;
@@ -35,7 +36,7 @@ export async function selectMessageKey(chain, targetCounter) {
         if (idx === -1) {
             throw new Error('duplicate message');
         }
-        const messageKey = unused[idx];
+        const messageKey = decodeSignalMessageKey(unused[idx], `unusedMsgKeys[${idx}]`);
         const nextUnused = removeAt(unused, idx);
         return {
             messageKey,
@@ -73,7 +74,12 @@ export async function selectMessageKey(chain, targetCounter) {
             overflow -= 1;
         }
         else {
-            nextUnused.push(currentMessageKey);
+            nextUnused.push({
+                index: currentMessageKey.index,
+                cipherKey: currentMessageKey.cipherKey,
+                macKey: currentMessageKey.macKey,
+                iv: currentMessageKey.iv
+            });
         }
         const derived = await deriveMsgKeyFromState(counter, chainState);
         currentMessageKey = derived.messageKey;
@@ -174,13 +180,14 @@ export async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
     }
     catch (error) {
         for (let i = 0; i < session.prevSessions.length; i += 1) {
-            const prevSession = snapshotToRecord(session.prevSessions[i]);
+            const decodedPrev = decodeSignalSessionSnapshot(session.prevSessions[i], `prevSessions[${i}]`);
+            const prevSession = snapshotToRecord(decodedPrev);
             try {
                 const [updatedPrev, plaintext] = await decryptMsgFromSession(prevSession, parsed);
                 const updatedSession = {
                     ...updatedPrev,
                     prevSessions: [
-                        detachSession(session),
+                        encodeSignalSessionSnapshot(detachSession(session)),
                         ...session.prevSessions.slice(0, i),
                         ...session.prevSessions.slice(i + 1)
                     ]
@@ -207,7 +214,10 @@ export async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
 }
 export async function decryptMsgFromSession(session, message) {
     const ratchetPubKey = toSerializedPubKey(message.ratchetPubKey);
-    const recvChainIndex = session.recvChains.findIndex((entry) => uint8Equal(entry.ratchetPubKey, ratchetPubKey));
+    const recvChainIndex = session.recvChains.findIndex((raw) => {
+        const key = raw.senderRatchetKey;
+        return key !== null && key !== undefined && uint8Equal(key, ratchetPubKey);
+    });
     let selectedMessageKey;
     let updatedSession;
     if (recvChainIndex === -1) {
@@ -225,7 +235,7 @@ export async function decryptMsgFromSession(session, message) {
         selectedMessageKey = selected.messageKey;
         const sendRatchet = await calculateRatchet(recvRatchet.rootKey, newSendRatchet, ratchetPubKey);
         const nextRecvChains = session.recvChains.slice(-MAX_TRACKED_RECV_CHAINS);
-        nextRecvChains.push(selected.updatedChain);
+        nextRecvChains.push(encodeSignalRecvChain(selected.updatedChain));
         updatedSession = {
             ...session,
             rootKey: sendRatchet.rootKey,
@@ -240,10 +250,11 @@ export async function decryptMsgFromSession(session, message) {
         };
     }
     else {
-        const selected = await selectMessageKey(session.recvChains[recvChainIndex], message.counter);
+        const decoded = decodeSignalRecvChain(session.recvChains[recvChainIndex], `recvChains[${recvChainIndex}]`);
+        const selected = await selectMessageKey(decoded, message.counter);
         selectedMessageKey = selected.messageKey;
         const nextRecvChains = session.recvChains.slice();
-        nextRecvChains[recvChainIndex] = selected.updatedChain;
+        nextRecvChains[recvChainIndex] = encodeSignalRecvChain(selected.updatedChain);
         updatedSession = {
             ...session,
             recvChains: nextRecvChains

package/dist/esm/signal/session/SignalSerializer.js

@@ -1,7 +1,6 @@
 import { readVersionedContent, toSerializedPubKey } from '../../crypto/index.js';
 import { proto } from '../../proto.js';
 import { SIGNAL_MAC_SIZE, SIGNAL_VERSION } from '../constants.js';
-import { toBytesView } from '../../util/bytes.js';
 export function deserializeMsg(versionContentMac) {
     const content = readVersionedContent(versionContentMac, SIGNAL_VERSION, SIGNAL_MAC_SIZE);
     const parsed = proto.SignalMessage.decode(content);
@@ -14,9 +13,9 @@ export function deserializeMsg(versionContentMac) {
         throw new Error('invalid signal message');
     }
     return {
-        ratchetPubKey: toSerializedPubKey(toBytesView(parsed.ratchetKey)),
+        ratchetPubKey: toSerializedPubKey(parsed.ratchetKey),
         counter: parsed.counter,
-        ciphertext: toBytesView(parsed.ciphertext),
+        ciphertext: parsed.ciphertext,
         versionContentMac
     };
 }
@@ -35,14 +34,14 @@ export function deserializePkMsg(versionContent) {
         parsed.message === undefined) {
         throw new Error('invalid prekey signal message');
     }
-    const signal = deserializeMsg(toBytesView(parsed.message));
+    const signal = deserializeMsg(parsed.message);
     return {
         ...signal,
         remote: {
             regId: parsed.registrationId,
-            pubKey: toSerializedPubKey(toBytesView(parsed.identityKey))
+            pubKey: toSerializedPubKey(parsed.identityKey)
         },
-        sessionBaseKey: toSerializedPubKey(toBytesView(parsed.baseKey)),
+        sessionBaseKey: toSerializedPubKey(parsed.baseKey),
         localSignedPreKeyId: parsed.signedPreKeyId,
         localOneTimeKeyId: parsed.preKeyId ?? null
     };

package/dist/esm/signal/session/SignalSession.js

@@ -1,5 +1,6 @@
 import { hkdfSplit, toRawPubKey, toSerializedPubKey, X25519 } from '../../crypto/index.js';
 import { SIGNAL_PREFIX } from '../constants.js';
+import { decodeSignalSessionSnapshot, encodeSignalSessionSnapshot } from '../encoding.js';
 import { concatBytes, uint8Equal } from '../../util/bytes.js';
 export function snapshotToRecord(snapshot) {
     return {
@@ -21,19 +22,21 @@ export function findMatchingSession(session, sessionBaseKey) {
         return session;
     }
     for (let index = 0; index < session.prevSessions.length; index += 1) {
-        const previousSession = session.prevSessions[index];
-        if (!previousSession.aliceBaseKey ||
-            !uint8Equal(previousSession.aliceBaseKey, serializedBaseKey)) {
+        const rawPrev = session.prevSessions[index];
+        if (!rawPrev.aliceBaseKey || !uint8Equal(rawPrev.aliceBaseKey, serializedBaseKey)) {
             continue;
         }
-        const prevSessions = [detachSession(session)];
+        const decoded = decodeSignalSessionSnapshot(rawPrev, `prevSessions[${index}]`);
+        const prevSessions = [
+            encodeSignalSessionSnapshot(detachSession(session))
+        ];
         for (let i = 0; i < session.prevSessions.length; i += 1) {
             if (i !== index) {
                 prevSessions.push(session.prevSessions[i]);
             }
         }
         return {
-            ...previousSession,
+            ...decoded,
             prevSessions
         };
     }
@@ -73,10 +76,9 @@ export async function initiateSessionOutgoing(local, remoteBundle, localOneTimeB
     ]);
     const [rootKey, chainKey] = await hkdfSplit(secret, null, 'WhisperText');
     const recvChain = {
-        ratchetPubKey: remoteRatchetKey,
-        nextMsgIndex: 0,
-        chainKey,
-        unusedMsgKeys: []
+        senderRatchetKey: remoteRatchetKey,
+        chainKey: { index: 0, key: chainKey },
+        messageKeys: []
     };
     const sendRatchet = await generateSerializedKeyPair();
     const sendRatchetResult = await calculateRatchet(rootKey, sendRatchet, remoteRatchetKey);