feat: add client-side identity system, rate limiting, proxy hardening, and full test suite
### Major changes
- **Client-side identity** — New session key store (`sessionKey.ts`) backed by
`sessionStorage` with a module-level caching, a `crypto.subtle` cache, a `useIdentityLock`
hook for decrypt-once signing, `followSignature.ts` for signed follows, and
two new UI modals (`IdentityBackup.tsx`, `UnlockIdentityModal.tsx`).
`CreateIdentity.tsx` is rewritten to generate BIP-39 mnemonics and encrypt the
Ed25519 keypair with AES-256-GCM via PBKDF2 (600k iterations) before storing
in IndexedDB.
- **Rate limiting** — New `rate-limit-config.ts` and `rate-limit.ts` provide a
per-IP sliding-window rate limiter backed by Redis. All external-facing routes
(`/discover`, `/discover/rotate/*`, `/proxy`, social API endpoints) now have
conservative defaults wired into the custom HTTP server before requests reach
Next.js handlers.
- **Proxy route hardening** — The `/proxy` route now enforces a 256 KB payload
limit (HTTP 413), validates JSON before parsing, applies a per-origin rate
limit (100 req/min), and imports the `blocks` table to reject requests from
blocked servers.
- **Docker integration-test cluster** — New `Dockerfile`, `.dockerignore`, and
`tests/docker-compose.yml` orchestrate three SiPher instances (A, B, C) plus
shared PostgreSQL and Redis. Key generation (`generate-keys.ts`) and discovery
setup (`setup-discovery.ts`) scripts automate cluster bootstrap. Three example
env files document required per-instance configuration.
- **Full test suite overhaul** — Replaces the old attack/auth/discover/key/proxy
tests with a structured suite:
* `tests/federation/` — Keytools unit tests + key-rotation e2e test
* `tests/proxy/` — Proxy relay e2e tests (single-server validation)
* `tests/integration/` — Multi-instance integration tests for discover,
proxy-chain relay, and federated post delivery via BullMQ
* `tests/helpers/` — Reusable DB, identity, and auth-user utilities
* Playwright config updated to match new file conventions
* Unused helpers (`tests/helpers/queue.ts`) removed
- **Social plugin endpoints** — Rewritten `follows.ts`, `blocks.ts`, `mutes.ts`,
and `posts.ts` with proper federation integration. `social.ts` gains helpers
for looking up posts by federation URL.
### Minor changes
- **README** — Expanded from a 42-line stub to a full architecture guide with
tables for every layer (auth, DB, queues, storage, real-time), API route
documentation, setup instructions, environment variables, test coverage, and
the updated roadmap.
- **Federation helpers** — `keytools.ts` refactors imports and cleans up the public surface.
`fetch.ts`, `registry.ts`, and `proxy-helpers/federated-post.ts` pick up small
improvements. `PostFederationSchema` simplifies its encryption type assertion.
- **Plugin infrastructure** — Oven plugin schema and server index gain minor
refactors. Social client adds a `muteUser` method.
- **UI components** — `switch.tsx` and `tooltip.tsx` rewritten for Radix v2 /
Tailwind 4; `accordion.tsx`, `dropdown-menu.tsx`, `form`, `button`, `card` get
minor consistency fixes. `dialog.tsx` removes unused `DialogHeader`.
- **Server bootstrap** — `server.ts` imports DB schema before `instrumentation`
for correct Drizzle initialization, rate-limiting routes are wired, and CORS
allows federation origins. `auth.ts` regenerates Oven and social plugin schemas.
- **Dependencies** — Added `@noble/ciphers` and `@noble/hashes` (crypto
primitives). Removed `@signalapp/libsignal-client`, `base58-js`, `nanostores`,
`tweetnacl-util`, `dexie-react-hooks`, `socket.io-client`. Updated all Better
Auth packages to 1.6.11, BullMQ to 5.76.10, and various dev deps across the
board.
- **.gitignore** — Added `/audits` and `tests/docker/*.env` to prevent secret
leakage.
- **DB schema** — `blocks` table imported in `src/lib/db/schema/index.ts`.
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Nixyan
parent
e943fe227f
commit
660c17b319
84 changed files with 7561 additions and 4617 deletions
23
.dockerignore
Normal file
23
.dockerignore
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Deps and build output — reinstalled inside the image
|
||||||
|
node_modules
|
||||||
|
.next
|
||||||
|
out
|
||||||
|
build
|
||||||
|
|
||||||
|
# Local environment — secrets must come from Docker Compose, not the image
|
||||||
|
.env.local
|
||||||
|
.env
|
||||||
|
|
||||||
|
# Tests and tooling output — not needed at runtime
|
||||||
|
test-results
|
||||||
|
playwright-report
|
||||||
|
blob-report
|
||||||
|
coverage
|
||||||
|
|
||||||
|
# Version control
|
||||||
|
.git
|
||||||
|
.gitignore
|
||||||
|
|
||||||
|
# Editor artefacts
|
||||||
|
.DS_Store
|
||||||
|
*.pem
|
||||||
7
.gitignore
vendored
7
.gitignore
vendored
|
|
@ -23,6 +23,7 @@
|
||||||
# misc
|
# misc
|
||||||
.DS_Store
|
.DS_Store
|
||||||
*.pem
|
*.pem
|
||||||
|
/audits
|
||||||
|
|
||||||
# debug
|
# debug
|
||||||
npm-debug.log*
|
npm-debug.log*
|
||||||
|
|
@ -34,6 +35,12 @@ yarn-error.log*
|
||||||
.env.local
|
.env.local
|
||||||
.env
|
.env
|
||||||
|
|
||||||
|
# Docker instance env files (contain federation keys + secrets)
|
||||||
|
# Regenerate with: bun run docker:generate-keys
|
||||||
|
tests/docker/sipher-a.env
|
||||||
|
tests/docker/sipher-b.env
|
||||||
|
tests/docker/sipher-c.env
|
||||||
|
|
||||||
# vercel
|
# vercel
|
||||||
.vercel
|
.vercel
|
||||||
|
|
||||||
|
|
|
||||||
27
Dockerfile
Normal file
27
Dockerfile
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
FROM node:22
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
# ---- Bun ----
|
||||||
|
RUN curl -fsSL https://bun.sh/install | bash
|
||||||
|
ENV PATH="/root/.bun/bin:$PATH"
|
||||||
|
|
||||||
|
# ---- dependencies ----
|
||||||
|
# Copy lockfile first so this layer is only rebuilt when deps change.
|
||||||
|
COPY package.json bun.lock ./
|
||||||
|
RUN bun install --frozen-lockfile
|
||||||
|
|
||||||
|
# Some packages ship pre-built native binaries via a post-install download script.
|
||||||
|
# Run it here so the layer is cached and not re-downloaded on every code change.
|
||||||
|
RUN bun run build:matrix || true
|
||||||
|
|
||||||
|
# ---- source ----
|
||||||
|
COPY . .
|
||||||
|
|
||||||
|
# Never bake secrets into the image; env vars come from Docker Compose or the host.
|
||||||
|
RUN rm -f .env.local
|
||||||
|
|
||||||
|
EXPOSE 3000
|
||||||
|
|
||||||
|
# Bun runs TypeScript natively — no separate tsx invocation needed.
|
||||||
|
CMD ["bun", "run", "src/server.ts"]
|
||||||
390
README.md
390
README.md
|
|
@ -1,42 +1,270 @@
|
||||||
# SiPher
|
# SiPher
|
||||||
|
|
||||||
> *Silent Whisper — A federated social network built for the modern age.*
|
> *Silent Whisper — A federated social network built for the modern age.*
|
||||||
|
|
||||||
[](./LICENSE)
|
[](./LICENSE)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
SiPher is a federated social network. Each server is independent — no central authority, no single point of failure.
|
SiPher is a federated social network. Each server is independent, no central authority, no single point of failure.
|
||||||
|
|
||||||
Your identity is `you@yourserver.com`. Your server, your data, your rules.
|
Your identity is `you@<base58_id>`. Your data, your rules.
|
||||||
|
|
||||||
|
Every user controls their own Ed25519 keypair generated from a BIP-39 mnemonic. The secret key never leaves the browser. Posts, follows, and every social action are signed client-side and verified server-side.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Roadmap
|
## Architecture
|
||||||
|
|
||||||
|
SiPher runs as a single Node.js process that serves both the web app and the federation API.
|
||||||
|
|
||||||
|
|
||||||
|
| Layer | Technology |
|
||||||
|
| -------------- | ------------------------------------------------------------------------------------- |
|
||||||
|
| Framework | Next.js 16 (App Router, React 19, standalone output) |
|
||||||
|
| Authentication | [Better Auth](https://better-auth.com) — email/password, username, 2FA, bearer tokens |
|
||||||
|
| Database | PostgreSQL via [Drizzle ORM](https://orm.drizzle.team) |
|
||||||
|
| Cache / Queues | Redis — session storage, rate limiting, BullMQ background jobs |
|
||||||
|
| Object Storage | MinIO (S3-compatible) — media uploads with presigned URLs |
|
||||||
|
| Client Storage | IndexedDB (Dexie) — encrypted identity keypairs |
|
||||||
|
| Real-time | Socket.IO — firehose channel for live updates |
|
||||||
|
| UI | Tailwind CSS v4, shadcn/ui, Radix primitives, Framer Motion |
|
||||||
|
|
||||||
|
|
||||||
|
### Custom Better Auth Plugins
|
||||||
|
|
||||||
|
SiPher extends Better Auth with three custom plugins, each registering its own database schema and API endpoints:
|
||||||
|
|
||||||
|
- **sipher-federation** — Server registry, key rotation challenges, blacklist management.
|
||||||
|
- **sipher-social** — Posts, follows, blocks, mutes as Better Auth API endpoints.
|
||||||
|
- **sipher-oven** — E2EE identity registration (Ed25519 keys, OLM device key bundles).
|
||||||
|
|
||||||
|
### API Routes
|
||||||
|
|
||||||
|
|
||||||
|
| Route | Purpose |
|
||||||
|
| -------------------------------- | -------------------------------------------------- |
|
||||||
|
| `GET /discover` | Return this server's public keys and healthy peers |
|
||||||
|
| `POST /discover` | Discover or register a remote server |
|
||||||
|
| `POST /discover/rotate/init` | Initiate key rotation (4 challenges) |
|
||||||
|
| `POST /discover/rotate/confirm` | Submit key rotation proofs |
|
||||||
|
| `POST /proxy` | Relay federation traffic through a proxy peer |
|
||||||
|
| `POST /api/auth/social/posts` | Create or receive a federated post |
|
||||||
|
| `GET /api/auth/social/posts/:id` | Get a post |
|
||||||
|
| `POST /api/auth/social/follows` | Follow, respond, or federate a follow |
|
||||||
|
| `POST /api/auth/social/blocks` | Block a user (auto-cleanses follows both ways) |
|
||||||
|
| `POST /api/auth/social/mutes` | Mute a user |
|
||||||
|
| `POST /oven/identity/register` | Register a user's public identity key |
|
||||||
|
| `POST /oven/keys/upload` | Upload OLM device key bundle |
|
||||||
|
| `GET /oven/identity/check` | Check identity registration status |
|
||||||
|
|
||||||
- **Phase 1** — Core federation. Two servers can follow each other, post, and see each other's posts.
|
|
||||||
- - [X] — Two servers can follow each other, trust their keys and rotate them.
|
|
||||||
- - [ ] — One server can create posts, have users following each other and dms (unencrypted for now) works.
|
|
||||||
- - [ ] — Two servers can fetch posts, follows and other data from their users, including DMs.
|
|
||||||
- **Phase 2** — Server trust scoring and a public vouch ledger.
|
|
||||||
- - [ ] — Add a "nuke" endpoint where if a federation loses their old keys and cannot rotate them, it'll nuke everything and make the other federations reset that federation score.
|
|
||||||
- **Phase 3** — Opt-in relay network for censorship resistance.
|
|
||||||
- **Phase 4** — End-to-end encryption via TBD.
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Instructions
|
## Identity & E2EE
|
||||||
|
|
||||||
<details>
|
### User Identity (the "Oven")
|
||||||
<summary><strong>Rotating Federation Keys</strong></summary>
|
|
||||||
|
Every SiPher user has a cryptographic identity generated entirely in the browser:
|
||||||
|
|
||||||
|
1. A **BIP-39 mnemonic** (12 words, 128-bit entropy) is generated.
|
||||||
|
2. An **Ed25519 keypair** is derived from the mnemonic seed via HKDF-SHA256.
|
||||||
|
3. The keypair is **encrypted with AES-256-GCM** and stored in IndexedDB via Dexie. The encryption key is derived from the user's master password (PBKDF2, 600k iterations).
|
||||||
|
4. The public key (base58) and a fingerprint are uploaded to the server.
|
||||||
|
5. **OLM device keys** are generated and all public keys are uploaded to the server for Matrix-protocol-based E2EE messaging.
|
||||||
|
|
||||||
|
### Session Key Store
|
||||||
|
|
||||||
|
Once unlocked, the Ed25519 keypair is held in module-level memory and `sessionStorage`. The sessionStorage layer means the key survives hard page reloads within the same tab but is cleared when the tab closes. It is intentionally NOT stored in `localStorage`.
|
||||||
|
|
||||||
|
The session key store exposes a simple `sign(message)` function that uses the cached secret key. For one-shot operations where you don't want to cache the key across the session, the Oven plugin provides `useSigningKey` — a callback API that decrypts the key, hands the caller a sign closure, and zeroes the in-memory secret immediately after the callback resolves. The secret never escapes that scope.
|
||||||
|
|
||||||
|
### Unlock Flow
|
||||||
|
|
||||||
|
1. On page load, `UnlockIdentityModal` tries `restoreSessionKey()` from sessionStorage.
|
||||||
|
2. If that fails, the user is prompted for their master password.
|
||||||
|
3. On correct password, `unlockSessionKey()` decrypts the Dexie blob, caches the keypair, and notifies listeners via a pub/sub pattern.
|
||||||
|
4. On logout, `clearSessionKey()` zeroes the in-memory secret and clears sessionStorage.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Federation
|
||||||
|
|
||||||
|
### Discovery & Registration
|
||||||
|
|
||||||
|
Every server exposes its public keys via `GET /discover`. A server can register a peer by sending a `REGISTER` request to the peer's `/discover` endpoint. The registration flow:
|
||||||
|
|
||||||
|
1. Validates the URL is safe (SSRF guard — see Security section).
|
||||||
|
2. Fetches the remote `/discover` to confirm the claimed keys match.
|
||||||
|
3. Upserts into the `serverRegistry` table.
|
||||||
|
4. Returns an echo of the registering server's own keys.
|
||||||
|
|
||||||
|
The `DISCOVER` method lets a server look up another server by signing public key and confirm that the stored keys still match the live peer.
|
||||||
|
|
||||||
|
### Proxy Relay
|
||||||
|
|
||||||
|
When two servers cannot reach each other directly (censorship, NAT, firewall), traffic can be routed through a mutual peer:
|
||||||
|
|
||||||
|
- **PROXY method** — Server A sends an encrypted payload + target URL + its public keys to proxy peer B. B verifies both A and C are registered, forwards to C as a `TARGETED` request, and returns the encrypted response.
|
||||||
|
- **TARGETED method** — Server C decrypts the inner payload, validates signatures, processes the action (follow, post), and returns an encrypted acknowledgment.
|
||||||
|
|
||||||
|
The proxy **never sees plaintext content**. It only knows "Server A is talking to Server B."
|
||||||
|
|
||||||
|
A threat model (`threat-model.ts`) classifies network errors and determines whether proxy fallback is eligible:
|
||||||
|
|
||||||
|
|
||||||
|
| Error | Proxy-Eligible | Direct Health-Checkable |
|
||||||
|
| ---------------- | -------------- | ----------------------- |
|
||||||
|
| DNS_BLOCKED | Yes | No |
|
||||||
|
| TLS_ERROR | No | Yes |
|
||||||
|
| TIMEOUT | No | Yes |
|
||||||
|
| CONN_REFUSED | No | Yes |
|
||||||
|
| INVALID_RESPONSE | Yes | No |
|
||||||
|
|
||||||
|
|
||||||
|
### Background Jobs (BullMQ)
|
||||||
|
|
||||||
|
Two Redis-backed queues handle asynchronous federation operations:
|
||||||
|
|
||||||
|
- **Federation delivery queue** — Encrypts and delivers activity (follows, posts, unfollows) to remote servers. 10 concurrent workers, up to 5 retries with exponential backoff (5s base). On success, the delivery job record is cleaned up automatically.
|
||||||
|
- **Health-check queue** — Probes unhealthy servers via `GET /discover` with exponential backoff (5min, 15min, 25min...), up to 5 attempts. If a server responds, it is re-marked healthy.
|
||||||
|
|
||||||
|
Workers are started automatically at application bootstrap via Next.js `instrumentation.ts`.
|
||||||
|
|
||||||
|
### Key Rotation
|
||||||
|
|
||||||
Federation identity is tied to two keypairs (Ed25519 for signing, X25519 for encryption). The `rotateKeys.ts` script walks through every known federation, proves ownership of both the old and new keys via a challenge-response protocol, and updates `.env.local` when all federations confirm.
|
Federation identity is tied to two keypairs (Ed25519 for signing, X25519 for encryption). The `rotateKeys.ts` script walks through every known federation, proves ownership of both the old and new keys via a challenge-response protocol, and updates `.env.local` when all federations confirm.
|
||||||
|
|
||||||
You **need** the old keys in order to run this script, if you lost them, you'll have to use the nuke endpoint. (Yet to be made)
|
Each rotation requires proving possession of **four** things to each peer:
|
||||||
|
|
||||||
|
1. Old signing key (sign a challenge nonce)
|
||||||
|
2. New signing key (sign a challenge nonce)
|
||||||
|
3. Old encryption key (decrypt a challenge nonce)
|
||||||
|
4. New encryption key (decrypt a challenge nonce)
|
||||||
|
|
||||||
|
Failed confirmations do **not** auto-blacklist the server — preventing griefing attacks where anyone could spam init for a victim URL to get them banned.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Setup
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- [Node.js](https://nodejs.org/) 20+
|
||||||
|
- [Bun](https://bun.sh/) (for tooling scripts and key generation)
|
||||||
|
- [PostgreSQL](https://www.postgresql.org/) 15+
|
||||||
|
- [Redis](https://redis.io/) 7+
|
||||||
|
- (Optional) [MinIO](https://min.io/) or any S3-compatible object store for media
|
||||||
|
|
||||||
|
### Environment Variables
|
||||||
|
|
||||||
|
Copy `.env.local.example` to `.env.local` and populate:
|
||||||
|
|
||||||
|
```env
|
||||||
|
# SiPher server URL (your canonical public address)
|
||||||
|
BETTER_AUTH_URL=https://your-server.com
|
||||||
|
|
||||||
|
# Better Auth secret (generate with: openssl rand -hex 32)
|
||||||
|
BETTER_AUTH_SECRET=<random-hex>
|
||||||
|
|
||||||
|
# PostgreSQL connection
|
||||||
|
DATABASE_URL=postgresql://user:password@host:5432/sipher
|
||||||
|
|
||||||
|
# Redis connection
|
||||||
|
REDIS_URL=redis://host:6379
|
||||||
|
|
||||||
|
# Federation signing keypair (Ed25519, base64)
|
||||||
|
# Generate with: npm run keygen
|
||||||
|
FEDERATION_PUBLIC_KEY=<base64>
|
||||||
|
FEDERATION_PRIVATE_KEY=<base64>
|
||||||
|
|
||||||
|
# Federation encryption keypair (X25519, base64)
|
||||||
|
FEDERATION_ENCRYPTION_PUBLIC_KEY=<base64>
|
||||||
|
FEDERATION_ENCRYPTION_PRIVATE_KEY=<base64>
|
||||||
|
|
||||||
|
# MinIO / S3 storage (optional, only if using media uploads)
|
||||||
|
MINIO_BUCKET=sipher
|
||||||
|
MINIO_ENDPOINT=minio.your-server.com
|
||||||
|
MINIO_PORT=443
|
||||||
|
MINIO_USE_SSL=true
|
||||||
|
MINIO_ACCESS_KEY=<access-key>
|
||||||
|
MINIO_SECRET_KEY=<secret-key>
|
||||||
|
|
||||||
|
# SMTP email (optional, used for verification emails)
|
||||||
|
EMAIL_HOST=smtp.your-server.com
|
||||||
|
EMAIL_PORT=587
|
||||||
|
EMAIL_SECURE=false
|
||||||
|
EMAIL_USER=noreply@your-server.com
|
||||||
|
EMAIL_PASSWORD=<password>
|
||||||
|
|
||||||
|
# Development only: override SSRF guard to allow private IPs
|
||||||
|
# DEV_ALLOWED_HOSTNAMES=localhost,127.0.0.1,::1
|
||||||
|
|
||||||
|
# Debug logging namespaces
|
||||||
|
DEBUG=app:*,test:*
|
||||||
|
```
|
||||||
|
|
||||||
|
### Database
|
||||||
|
|
||||||
|
The schema is managed via Drizzle Kit. Everything is auto-generated from Better Auth's schema generator plus the custom plugin schemas.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
# Push schema directly (development)
|
||||||
|
npm run db:push
|
||||||
|
|
||||||
|
# Or generate a migration and apply it
|
||||||
|
npm run db:generate
|
||||||
|
npm run db:migrate
|
||||||
|
```
|
||||||
|
|
||||||
|
### Federation Keys
|
||||||
|
|
||||||
|
```sh
|
||||||
|
npm run keygen
|
||||||
|
```
|
||||||
|
|
||||||
|
This runs `src/lib/federation/keygen.ts`, which generates both Ed25519 (signing) and X25519 (encryption) keypairs and writes them to `.env.local`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Scripts
|
||||||
|
|
||||||
|
|
||||||
|
| Command | Purpose |
|
||||||
|
| ----------------------------------- | ------------------------------------------------------------- |
|
||||||
|
| `npm run dev` | Start development server (enables private URLs for local dev) |
|
||||||
|
| `npm run build` | `next build` |
|
||||||
|
| `npm run start` | Production start (`node src/server.ts`) |
|
||||||
|
| `npm run keygen` | Generate federation signing + encryption keys |
|
||||||
|
| `npm run build:matrix` | Download native Matrix crypto WASM binary |
|
||||||
|
| `npm run email:dev` | React Email dev server (port 3001) |
|
||||||
|
| `npm run db:push` | Push Drizzle schema to database |
|
||||||
|
| `npm run db:migrate` | Push + migrate (two-step) |
|
||||||
|
| `npm run db:generate` | Regenerate Better Auth schema + Drizzle files |
|
||||||
|
| `npm run db:update` | Generate + push |
|
||||||
|
| `npm run test` | Run Playwright e2e tests (`**/*.e2e.ts`) |
|
||||||
|
| `npm run test:federation` | Key rotation e2e tests |
|
||||||
|
| `npm run test:key` | Key rotation e2e tests only |
|
||||||
|
| `npm run test:proxy` | Proxy `/proxy` route e2e tests (single-server validation) |
|
||||||
|
| `npm run docker:test:discover` | `/discover` integration tests against the 3-instance cluster |
|
||||||
|
| `npm run docker:test:proxy-chain` | Proxy relay + failover integration tests |
|
||||||
|
| `npm run docker:test:post-delivery` | Federated post delivery integration test |
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Rotating Federation Keys
|
||||||
|
|
||||||
|
**Rotating Federation Keys**
|
||||||
|
|
||||||
|
Federation identity is tied to two keypairs (Ed25519 for signing, X25519 for encryption). The `rotateKeys.ts` script walks through every known federation, proves ownership of both the old and new keys via a challenge-response protocol, and updates `.env.local` when all federations confirm.
|
||||||
|
|
||||||
|
You **need** the old keys in order to run this script. If you lost them, there is currently no recovery mechanism.
|
||||||
|
|
||||||
### Prerequisites
|
### Prerequisites
|
||||||
|
|
||||||
- A running database with the server registry populated (at least one peer federation).
|
- A running database with the server registry populated (at least one peer federation).
|
||||||
- `.env.local` with valid `FEDERATION_*` keys and `BETTER_AUTH_URL`.
|
- `.env.local` with valid `FEDERATION_`* keys and `BETTER_AUTH_URL`.
|
||||||
|
|
||||||
### Basic rotation
|
### Basic rotation
|
||||||
|
|
||||||
|
|
@ -69,9 +297,112 @@ You can also retry all federations with just `--resume`:
|
||||||
bun run rotateKeys.ts --resume '<keys-json>'
|
bun run rotateKeys.ts --resume '<keys-json>'
|
||||||
```
|
```
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Tests
|
||||||
|
|
||||||
|
SiPher uses [Playwright](https://playwright.dev) for integration/e2e tests (matched by `**/*.e2e.ts`) and [Bun's test runner](https://bun.sh/docs/cli/test) for unit tests (matched by `**/*.test.ts`).
|
||||||
|
|
||||||
|
### Running tests
|
||||||
|
|
||||||
|
```sh
|
||||||
|
npm test # All Playwright e2e tests
|
||||||
|
npm run test:federation # Discover + key rotation tests
|
||||||
|
npm run test:proxy # Proxy relay tests
|
||||||
|
bun test # Bun unit tests (keytools, etc.)
|
||||||
|
```
|
||||||
|
|
||||||
|
Playwright starts the server automatically via `tsx src/server.ts` with `NODE_ENV=test`. The Playwright suites that remain (`tests/proxy/proxy.e2e.ts`, `tests/federation/key-rotation.e2e.ts`) drive their own local DB state and don't need the federation cluster. Anything that exercises real peer-to-peer federation — `/discover` REGISTER/DISCOVER, proxy relay, federated post delivery — lives under `tests/integration/` and runs against the dockerized 3-instance cluster.
|
||||||
|
|
||||||
|
### Manual integration tests
|
||||||
|
|
||||||
|
Two manual scripts require three live instances with mutual discovery pre-configured:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
# Requires three running instances (A, B, C) with mutual discovery
|
||||||
|
bun run tests/integration/federation-post-delivery.ts --proxy <B_URL> --target <C_URL> --bearer <token>
|
||||||
|
bun run tests/integration/proxy-chain.ts --proxy <B_URL> --target <C_URL>
|
||||||
|
```
|
||||||
|
|
||||||
|
These test the Post → BullMQ delivery → proxy fallback pipeline and the full PROXY/TARGETED relay chain respectively.
|
||||||
|
|
||||||
|
### Test coverage
|
||||||
|
|
||||||
|
- **Discover e2e** — SSRF guards, key mismatch rejection, REGISTER and DISCOVER happy paths, encrypted envelope validation.
|
||||||
|
- **Key rotation e2e** — Full init → solve → confirm flow, rate limiting, expired challenges, exhausted attempts without blacklist-griefing.
|
||||||
|
- **Proxy e2e** — PROXY and TARGETED validation, unknown sender rejection, blacklist enforcement, signature verification, duplicate follow rejection, rate limiting, payload size limits.
|
||||||
|
- **Keytools unit** — Encryption round-trip, tamper detection, signature verification, deterministic fingerprinting.
|
||||||
|
- **Integration (manual)** — Post delivery via proxy fallback, full proxy chain relay.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Roadmap
|
||||||
|
|
||||||
|
- **[X] Federation key rotation** — Challenge-response protocol for rotating Ed25519 + X25519 keypairs across all peers.
|
||||||
|
- **[X] Proxy relay** — Traffic routed through mutual peers when direct connections fail. Proxy is blind to content.
|
||||||
|
- **[X] Background delivery** — BullMQ queues for async federation delivery with retries and health monitoring.
|
||||||
|
- **[X] Serialization format** — The JSON-based federation schema (EncryptedEnvelope, FollowSchema, PostFederationSchema).
|
||||||
|
- **[X] SSRF protection** — URL guard blocking private/internal IPs, blocked hostnames, non-HTTP protocols.
|
||||||
|
- **[X] Client-side identity** — BIP-39 mnemonics, Ed25519 keypairs, encrypted IndexedDB storage, session key cache.
|
||||||
|
- **[X] Rate limiting** — Per-route and per-origin sliding-window rate limits enforced server-side.
|
||||||
|
- **[X] Threat model** — Error-code classification dictating proxy eligibility and health-check strategy.
|
||||||
|
- **[ ] Discovery propagation** — When a new server is registered, propagate its existence to all known peers.
|
||||||
|
- **[ ] Server trust scoring** — A public vouch ledger so servers can signal trustworthiness about peers.
|
||||||
|
- **[ ] End-to-end encryption** — OLM device keys are already uploaded. The encrypted message transport ("Oven") needs to be wired into the messaging layer.
|
||||||
|
- **[ ] Web UI** — The frontend is minimal (dev test form and auth pages). A proper feed, profile pages, notifications, and settings UI need to be built.
|
||||||
|
- **[ ] Federation status dashboard** — View connected peers, health status, pending deliveries, and rotation logs.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## What is public/private?
|
||||||
|
|
||||||
|
### Public
|
||||||
|
|
||||||
|
There are things that won't be e2ee because there's simply no reason for that to be done. This is a small list of the public data that other federations or even users might fetch and get all of the data:
|
||||||
|
|
||||||
|
- **Posts**: The whole post object is public, including:
|
||||||
|
- The content, including images, videos, or audios if any
|
||||||
|
- Who posted it
|
||||||
|
- The federation that has that data
|
||||||
|
- **Profiles**: Username, display name, public key fingerprint
|
||||||
|
- **Follow graph**: Who follows whom (for federation routing)
|
||||||
|
|
||||||
|
### Private (server-side)
|
||||||
|
|
||||||
|
- **Direct messages**: Not yet end-to-end encrypted (stored on server in plaintext).
|
||||||
|
- **Mutes/blocks**: Stored server-side, not federated.
|
||||||
|
- **Passwords**: Hashed by Better Auth, never stored in plaintext.
|
||||||
|
|
||||||
|
### Private (client-side, never sent to server)
|
||||||
|
|
||||||
|
- **Ed25519 secret key**: Only exists in browser memory and encrypted IndexedDB.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security
|
||||||
|
|
||||||
|
SiPher implements custom federation and cryptographic protocols. I am not a professional cryptographer or security researcher — this system has not been audited and almost certainly contains multiple vulnerabilities I am not aware of.
|
||||||
|
|
||||||
|
### What SiPher does for safety
|
||||||
|
|
||||||
|
- **SSRF protection**: A URL guard (`url-guard.ts`) blocks requests to private/internal IPv4 ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local), IPv6 ULA and link-local addresses, blocked hostnames (localhost, metadata endpoints), and non-HTTP(S) protocols. Only overridable via `DEV_ALLOWED_HOSTNAMES` env var.
|
||||||
|
- **Federation encryption**: All cross-server payloads are encrypted with X25519 + AES-256-GCM (hybrid ECIES). Ephemeral keys per message.
|
||||||
|
- **Canonical signatures**: Posts and follows are signed with a versioned byte format (`v: 2`) that includes the federation URL to prevent cross-server replay attacks.
|
||||||
|
- **Key rotation requires 4 proofs**: Possession of both old and new keypairs must be proven before keys are updated. Failed confirmations don't auto-blacklist (prevents griefing).
|
||||||
|
- **No secret key on server**: User Ed25519 secret keys never leave the browser. The server only stores public keys and OLM device key bundles.
|
||||||
|
- **Session-scoped key caching**: The signing key lives in module memory + sessionStorage (not localStorage). It is zeroed on logout and cleared when the tab closes.
|
||||||
|
- **Rate limiting**: Per-route sliding-window limits prevent abuse of registration, key rotation, and proxy endpoints.
|
||||||
|
|
||||||
|
If you find a vulnerability, please open an issue or contact me directly at [tocka@tockanest.com](mailto:tocka@tockanest.com). Responsible disclosure is appreciated.
|
||||||
|
|
||||||
|
Contributions from people with security or cryptography experience are especially welcome, even if just pure criticism.
|
||||||
|
|
||||||
|
**Do not use SiPher in any context where your physical safety depends on it — not yet.**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Author
|
## Author
|
||||||
|
|
||||||
**Marcello Brito** (Tocka) — [tockanest.com](https://tockanest.com)
|
**Marcello Brito** (Tocka) — [tockanest.com](https://tockanest.com)
|
||||||
|
|
@ -82,29 +413,6 @@ bun run rotateKeys.ts --resume '<keys-json>'
|
||||||
|
|
||||||
[GitHub](https://github.com/tockawaffle/sipher)
|
[GitHub](https://github.com/tockawaffle/sipher)
|
||||||
|
|
||||||
## What is public/private?
|
|
||||||
|
|
||||||
### Public
|
|
||||||
|
|
||||||
There are things that won't be e2ee because there's simply no reason for that to be done, this is a small list of the current (not finished) public data that other federations or even users might fetch and get all of the data:
|
|
||||||
|
|
||||||
- Posts:
|
|
||||||
- - The whole post object is public, that includes:
|
|
||||||
- - - The content, including images, videos or audios if any
|
|
||||||
- - - Who posted it
|
|
||||||
- - - The federation that has that data
|
|
||||||
|
|
||||||
|
|
||||||
## Security
|
|
||||||
|
|
||||||
SiPher implements custom federation and cryptographic protocols. I am not a professional cryptographer or security researcher — this system has not been audited and almost certainly contains multiple vulnerabilities I am not aware of.
|
|
||||||
|
|
||||||
If you find one, please open an issue or contact me directly at tocka@tockanest.com. Responsible disclosure is appreciated.
|
|
||||||
|
|
||||||
Contributions from people with security or cryptography experience are especially welcome, even if just pure criticism.
|
|
||||||
|
|
||||||
**Do not use SiPher in any context where your physical safety depends on it — not yet.**
|
|
||||||
|
|
||||||
## License
|
## License
|
||||||
|
|
||||||
[AGPL-3.0](./LICENSE)
|
[AGPL-3.0](./LICENSE)
|
||||||
435
bun.lock
435
bun.lock
|
|
@ -5,62 +5,61 @@
|
||||||
"": {
|
"": {
|
||||||
"name": "sipher",
|
"name": "sipher",
|
||||||
"dependencies": {
|
"dependencies": {
|
||||||
"@better-auth/drizzle-adapter": "^1.6.9",
|
"@better-auth/drizzle-adapter": "^1.6.11",
|
||||||
"@hookform/resolvers": "^5.2.2",
|
"@hookform/resolvers": "^5.2.2",
|
||||||
"@matrix-org/matrix-sdk-crypto-wasm": "^18.2.0",
|
"@matrix-org/matrix-sdk-crypto-wasm": "^18.3.0",
|
||||||
"@nanostores/react": "^1.1.0",
|
"@noble/ciphers": "^2.2.0",
|
||||||
|
"@noble/hashes": "^2.2.0",
|
||||||
"@react-email/components": "1.0.12",
|
"@react-email/components": "1.0.12",
|
||||||
|
"@react-email/render": "^2.0.8",
|
||||||
|
"@react-email/tailwind": "^2.0.7",
|
||||||
"@scure/bip39": "^2.2.0",
|
"@scure/bip39": "^2.2.0",
|
||||||
"@signalapp/libsignal-client": "^0.92.2",
|
"better-auth": "^1.6.11",
|
||||||
"base58-js": "^3.0.3",
|
"bullmq": "^5.76.10",
|
||||||
"better-auth": "^1.6.9",
|
|
||||||
"bullmq": "^5.76.5",
|
|
||||||
"class-variance-authority": "^0.7.1",
|
"class-variance-authority": "^0.7.1",
|
||||||
"clsx": "^2.1.1",
|
"clsx": "^2.1.1",
|
||||||
"debug": "^4.4.3",
|
"debug": "^4.4.3",
|
||||||
"dexie": "^4.4.2",
|
"dexie": "^4.4.2",
|
||||||
"dexie-react-hooks": "^4.4.0",
|
|
||||||
"dotenv": "^17.4.2",
|
"dotenv": "^17.4.2",
|
||||||
"drizzle-orm": "^0.45.2",
|
"drizzle-orm": "^0.45.2",
|
||||||
"framer-motion": "^12.38.0",
|
"framer-motion": "^12.38.0",
|
||||||
"ioredis": "^5.10.1",
|
"ioredis": "^5.10.1",
|
||||||
"lucide-react": "^1.14.0",
|
"lucide-react": "^1.16.0",
|
||||||
"minio": "^8.0.7",
|
"minio": "^8.0.7",
|
||||||
"nanostores": "^1.3.0",
|
|
||||||
"next": "16.2.3",
|
"next": "16.2.3",
|
||||||
"next-themes": "^0.4.6",
|
"next-themes": "^0.4.6",
|
||||||
"nodemailer": "^8.0.7",
|
"nodemailer": "^8.0.7",
|
||||||
"pg": "^8.20.0",
|
"pg": "^8.21.0",
|
||||||
"radix-ui": "^1.4.3",
|
"radix-ui": "^1.4.3",
|
||||||
"react": "19.2.5",
|
"react": "19.2.5",
|
||||||
"react-dom": "19.2.5",
|
"react-dom": "19.2.5",
|
||||||
"react-hook-form": "^7.75.0",
|
"react-hook-form": "^7.76.0",
|
||||||
"socket.io": "^4.8.3",
|
"socket.io": "^4.8.3",
|
||||||
"socket.io-client": "^4.8.3",
|
|
||||||
"sonner": "^2.0.7",
|
"sonner": "^2.0.7",
|
||||||
"tailwind-merge": "^3.5.0",
|
"tailwind-merge": "^3.6.0",
|
||||||
"tweetnacl": "^1.0.3",
|
"tweetnacl": "^1.0.3",
|
||||||
"tweetnacl-util": "^0.15.1",
|
|
||||||
"uuid": "^14.0.0",
|
"uuid": "^14.0.0",
|
||||||
"zod": "^4.4.3",
|
"zod": "^4.4.3",
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@tailwindcss/postcss": "^4.2.4",
|
"@playwright/test": "^1.60.0",
|
||||||
"@types/bun": "^1.3.13",
|
"@react-email/preview-server": "^5.2.10",
|
||||||
|
"@tailwindcss/postcss": "^4.3.0",
|
||||||
|
"@types/bun": "^1.3.14",
|
||||||
"@types/debug": "^4.1.13",
|
"@types/debug": "^4.1.13",
|
||||||
"@types/node": "^25.6.0",
|
"@types/node": "^25.8.0",
|
||||||
"@types/nodemailer": "^8.0.0",
|
"@types/nodemailer": "^8.0.0",
|
||||||
"@types/pg": "^8.20.0",
|
"@types/pg": "^8.20.0",
|
||||||
"@types/react": "^19.2.14",
|
"@types/react": "^19.2.14",
|
||||||
"@types/react-dom": "^19.2.3",
|
"@types/react-dom": "^19.2.3",
|
||||||
"auth": "^1.6.9",
|
"auth": "^1.6.11",
|
||||||
"babel-plugin-react-compiler": "1.0.0",
|
"babel-plugin-react-compiler": "1.0.0",
|
||||||
"cross-env": "^10.1.0",
|
"cross-env": "^10.1.0",
|
||||||
"drizzle-kit": "^0.31.10",
|
"drizzle-kit": "^0.31.10",
|
||||||
"react-email": "5.2.10",
|
"react-email": "5.2.10",
|
||||||
"shadcn": "^4.6.0",
|
"shadcn": "^4.7.0",
|
||||||
"tailwindcss": "^4.2.4",
|
"tailwindcss": "^4.3.0",
|
||||||
"tsx": "^4.21.0",
|
"tsx": "^4.22.1",
|
||||||
"tw-animate-css": "^1.4.0",
|
"tw-animate-css": "^1.4.0",
|
||||||
"typescript": "^6.0.3",
|
"typescript": "^6.0.3",
|
||||||
},
|
},
|
||||||
|
|
@ -138,19 +137,19 @@
|
||||||
|
|
||||||
"@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
|
"@babel/types": ["@babel/types@7.29.0", "", { "dependencies": { "@babel/helper-string-parser": "^7.27.1", "@babel/helper-validator-identifier": "^7.28.5" } }, "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A=="],
|
||||||
|
|
||||||
"@better-auth/core": ["@better-auth/core@1.6.9", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-ADFk5pwmLybmc+LvYvXJ6M1x2oY/EyYLkwLuH0x28FUq12DfjL0wnE7g+WRDf3yozDO+qIxTpFGXDGwLKbfz0w=="],
|
"@better-auth/core": ["@better-auth/core@1.6.11", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-LrwidLCV8azdMGjvtwp30nj9tIv1BwI3VhtC0UaGSjQkAVWw4bN42I8qwbxRziPeSQoj+zUVkOpxZzAWBDARtQ=="],
|
||||||
|
|
||||||
"@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-Lcco5hOGrMgc4XKAkvB6x72eQm4wCcya8IevMg4wBHY9W9GVg8pu23rpRX6VsVQSO4Ux13S7lFwUWtF7/r9aKw=="],
|
"@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-4jpkETIGZOHCf7BK4jnu22fdN6jjomH0/HhEzkaWy3+Eppi5PYlHTF/460jrTmA3Xc+Vqwp9t282ymHiEPypGw=="],
|
||||||
|
|
||||||
"@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0", "kysely": "^0.28.14" }, "optionalPeers": ["kysely"] }, "sha512-gyjuuxJtZ4o9G9z9q4kqn24X2kvMSp7F+KHogYxF03SnXY/2WleAcuj57iC4wP3e9mGDbjPOrnM5K6Kr3Ktdpw=="],
|
"@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "kysely": "^0.28.17" }, "optionalPeers": ["kysely"] }, "sha512-/g8M9RfIjdcZDnbstSUvQiINkvdNlCeZr248zwqx2/PVksQI1MhQofbzUn3RnQnbPKp0EPwpX/dR3oudRFenUg=="],
|
||||||
|
|
||||||
"@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0" } }, "sha512-XmIG4tUnOXZ+KEcWjHUjOI9Z5donD09dC2t/AQTXifAUIqx7cySg86w0KTM09ArzAxRx1fCqO36Wkt5nULnrkQ=="],
|
"@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0" } }, "sha512-hpdfw0BBf8MuzLkIdmbcUZICbY9r/bhLO2RxSnkzT5+/O+0I0u2I8+m0YUP7vNllP/ZCKASHOYgXPLO75Z0f9Q=="],
|
||||||
|
|
||||||
"@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-h+AiRJ/TsBSi+ZDjySASBpbJ/9QCXBre34PSKgCz7QmTHrFM9Cg2EM4AM7LjR5lPXipEE+2rWPBc9wfnUBjhcw=="],
|
"@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-3Tor8rSv8vSEIMEaV2PFpPEuVhqc1gNoZ6eGvoh3LwExXXuj8madew6ob+H1pH7Aphn3Ar5PQ08AguT8TbwFAA=="],
|
||||||
|
|
||||||
"@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-XHks01ntK20orqK/jICq8wmEbJ/zT6dct49Fk8zTQKN9QNGDc+Ix5+7z/Kvui0DXGFf790GfvRozquzaLtXa8Q=="],
|
"@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-Pw+7q7zTp+VSci1V+CYMvuxIbAeVMZLe4lRo46LJoAKMHfjFl5T/ycsyFvWs/DkWC7n9gZZzRDEbHp0I5FiKKw=="],
|
||||||
|
|
||||||
"@better-auth/telemetry": ["@better-auth/telemetry@1.6.9", "", { "peerDependencies": { "@better-auth/core": "^1.6.9", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21" } }, "sha512-0u5zkhSCAQFoN3DHvUkLHOF6MBbVTDAa6mU8mhPwiysdz1x21vMzhzfaAKN/ZGWaQ09v91/F+2qu42G/bhUV4A=="],
|
"@better-auth/telemetry": ["@better-auth/telemetry@1.6.11", "", { "peerDependencies": { "@better-auth/core": "^1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21" } }, "sha512-hsjDHc8MZbm6/AHeNdtywrWedXevnBjmdvnHTcZub+rTVjOv+Td0roI8USKuC6uUibmrl//2rJfVCsGbopihNA=="],
|
||||||
|
|
||||||
"@better-auth/utils": ["@better-auth/utils@0.4.0", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-RpMtLUIQAEWMgdPLNVbIF5ON2mm+CH0U3rCdUCU1VyeAUui4m38DyK7/aXMLZov2YDjG684pS1D0MBllrmgjQA=="],
|
"@better-auth/utils": ["@better-auth/utils@0.4.0", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-RpMtLUIQAEWMgdPLNVbIF5ON2mm+CH0U3rCdUCU1VyeAUui4m38DyK7/aXMLZov2YDjG684pS1D0MBllrmgjQA=="],
|
||||||
|
|
||||||
|
|
@ -188,57 +187,57 @@
|
||||||
|
|
||||||
"@esbuild-kit/esm-loader": ["@esbuild-kit/esm-loader@2.6.5", "", { "dependencies": { "@esbuild-kit/core-utils": "^3.3.2", "get-tsconfig": "^4.7.0" } }, "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA=="],
|
"@esbuild-kit/esm-loader": ["@esbuild-kit/esm-loader@2.6.5", "", { "dependencies": { "@esbuild-kit/core-utils": "^3.3.2", "get-tsconfig": "^4.7.0" } }, "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA=="],
|
||||||
|
|
||||||
"@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
|
"@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.3", "", { "os": "aix", "cpu": "ppc64" }, "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg=="],
|
||||||
|
|
||||||
"@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
|
"@esbuild/android-arm": ["@esbuild/android-arm@0.27.3", "", { "os": "android", "cpu": "arm" }, "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA=="],
|
||||||
|
|
||||||
"@esbuild/android-arm64": ["@esbuild/android-arm64@0.25.12", "", { "os": "android", "cpu": "arm64" }, "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg=="],
|
"@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.3", "", { "os": "android", "cpu": "arm64" }, "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg=="],
|
||||||
|
|
||||||
"@esbuild/android-x64": ["@esbuild/android-x64@0.25.12", "", { "os": "android", "cpu": "x64" }, "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg=="],
|
"@esbuild/android-x64": ["@esbuild/android-x64@0.27.3", "", { "os": "android", "cpu": "x64" }, "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ=="],
|
||||||
|
|
||||||
"@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.25.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg=="],
|
"@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg=="],
|
||||||
|
|
||||||
"@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.25.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA=="],
|
"@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg=="],
|
||||||
|
|
||||||
"@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.25.12", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg=="],
|
"@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.3", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w=="],
|
||||||
|
|
||||||
"@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.25.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ=="],
|
"@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA=="],
|
||||||
|
|
||||||
"@esbuild/linux-arm": ["@esbuild/linux-arm@0.25.12", "", { "os": "linux", "cpu": "arm" }, "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw=="],
|
"@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.3", "", { "os": "linux", "cpu": "arm" }, "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw=="],
|
||||||
|
|
||||||
"@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.25.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ=="],
|
"@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg=="],
|
||||||
|
|
||||||
"@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.25.12", "", { "os": "linux", "cpu": "ia32" }, "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA=="],
|
"@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.3", "", { "os": "linux", "cpu": "ia32" }, "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg=="],
|
||||||
|
|
||||||
"@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng=="],
|
"@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA=="],
|
||||||
|
|
||||||
"@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw=="],
|
"@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw=="],
|
||||||
|
|
||||||
"@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.25.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA=="],
|
"@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA=="],
|
||||||
|
|
||||||
"@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w=="],
|
"@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ=="],
|
||||||
|
|
||||||
"@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.25.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg=="],
|
"@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw=="],
|
||||||
|
|
||||||
"@esbuild/linux-x64": ["@esbuild/linux-x64@0.25.12", "", { "os": "linux", "cpu": "x64" }, "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw=="],
|
"@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.3", "", { "os": "linux", "cpu": "x64" }, "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA=="],
|
||||||
|
|
||||||
"@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg=="],
|
"@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA=="],
|
||||||
|
|
||||||
"@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.25.12", "", { "os": "none", "cpu": "x64" }, "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ=="],
|
"@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.3", "", { "os": "none", "cpu": "x64" }, "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA=="],
|
||||||
|
|
||||||
"@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.25.12", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A=="],
|
"@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.3", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw=="],
|
||||||
|
|
||||||
"@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.25.12", "", { "os": "openbsd", "cpu": "x64" }, "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw=="],
|
"@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.3", "", { "os": "openbsd", "cpu": "x64" }, "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ=="],
|
||||||
|
|
||||||
"@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg=="],
|
"@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g=="],
|
||||||
|
|
||||||
"@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.25.12", "", { "os": "sunos", "cpu": "x64" }, "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w=="],
|
"@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.3", "", { "os": "sunos", "cpu": "x64" }, "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA=="],
|
||||||
|
|
||||||
"@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.25.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg=="],
|
"@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA=="],
|
||||||
|
|
||||||
"@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.25.12", "", { "os": "win32", "cpu": "ia32" }, "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ=="],
|
"@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q=="],
|
||||||
|
|
||||||
"@esbuild/win32-x64": ["@esbuild/win32-x64@0.25.12", "", { "os": "win32", "cpu": "x64" }, "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA=="],
|
"@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="],
|
||||||
|
|
||||||
"@floating-ui/core": ["@floating-ui/core@1.7.5", "", { "dependencies": { "@floating-ui/utils": "^0.2.11" } }, "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ=="],
|
"@floating-ui/core": ["@floating-ui/core@1.7.5", "", { "dependencies": { "@floating-ui/utils": "^0.2.11" } }, "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ=="],
|
||||||
|
|
||||||
|
|
@ -324,7 +323,7 @@
|
||||||
|
|
||||||
"@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
|
"@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
|
||||||
|
|
||||||
"@matrix-org/matrix-sdk-crypto-wasm": ["@matrix-org/matrix-sdk-crypto-wasm@18.2.0", "", {}, "sha512-puyZefvq6sHfqlmkri8umhA44724H2JL0YtX8wlvhGuNl8awX/Q1tZyW2Iekm9ZJP7BtuOqlNdg9oQd6iaGbNw=="],
|
"@matrix-org/matrix-sdk-crypto-wasm": ["@matrix-org/matrix-sdk-crypto-wasm@18.3.0", "", {}, "sha512-9a4feyt8QLysARu7PHKaRWT+wcCd+IYH074LXp9QK5WqfN4zUXueRhiSSMNT18Bm+8q3sBR/4zxDxOSDR0M8Kg=="],
|
||||||
|
|
||||||
"@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.27.1", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-sr6GbP+4edBwFndLbM60gf07z0FQ79gaExpnsjMGePXqFcSSb7t6iscpjk9DhFhwd+mTEQrzNafGP8/iGGFYaA=="],
|
"@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.27.1", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-sr6GbP+4edBwFndLbM60gf07z0FQ79gaExpnsjMGePXqFcSSb7t6iscpjk9DhFhwd+mTEQrzNafGP8/iGGFYaA=="],
|
||||||
|
|
||||||
|
|
@ -344,8 +343,6 @@
|
||||||
|
|
||||||
"@mswjs/interceptors": ["@mswjs/interceptors@0.41.3", "", { "dependencies": { "@open-draft/deferred-promise": "^2.2.0", "@open-draft/logger": "^0.3.0", "@open-draft/until": "^2.0.0", "is-node-process": "^1.2.0", "outvariant": "^1.4.3", "strict-event-emitter": "^0.5.1" } }, "sha512-cXu86tF4VQVfwz8W1SPbhoRyHJkti6mjH/XJIxp40jhO4j2k1m4KYrEykxqWPkFF3vrK4rgQppBh//AwyGSXPA=="],
|
"@mswjs/interceptors": ["@mswjs/interceptors@0.41.3", "", { "dependencies": { "@open-draft/deferred-promise": "^2.2.0", "@open-draft/logger": "^0.3.0", "@open-draft/until": "^2.0.0", "is-node-process": "^1.2.0", "outvariant": "^1.4.3", "strict-event-emitter": "^0.5.1" } }, "sha512-cXu86tF4VQVfwz8W1SPbhoRyHJkti6mjH/XJIxp40jhO4j2k1m4KYrEykxqWPkFF3vrK4rgQppBh//AwyGSXPA=="],
|
||||||
|
|
||||||
"@nanostores/react": ["@nanostores/react@1.1.0", "", { "peerDependencies": { "nanostores": "^1.2.0", "react": ">=18.0.0" } }, "sha512-MbH35fjhcf7LAubYX5vhOChYUfTLzNLqH/mBGLVsHkcvjy0F8crO1WQwdmQ2xKbAmtpalDa2zBt3Hlg5kqr8iw=="],
|
|
||||||
|
|
||||||
"@next/env": ["@next/env@16.2.3", "", {}, "sha512-ZWXyj4uNu4GCWQw9cjRxWlbD+33mcDszIo9iQxFnBX3Wmgq9ulaSJcl6VhuWx5pCWqqD+9W6Wfz7N0lM5lYPMA=="],
|
"@next/env": ["@next/env@16.2.3", "", {}, "sha512-ZWXyj4uNu4GCWQw9cjRxWlbD+33mcDszIo9iQxFnBX3Wmgq9ulaSJcl6VhuWx5pCWqqD+9W6Wfz7N0lM5lYPMA=="],
|
||||||
|
|
||||||
"@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.2.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-u37KDKTKQ+OQLvY+z7SNXixwo4Q2/IAJFDzU1fYe66IbCE51aDSAzkNDkWmLN0yjTUh4BKBd+hb69jYn6qqqSg=="],
|
"@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.2.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-u37KDKTKQ+OQLvY+z7SNXixwo4Q2/IAJFDzU1fYe66IbCE51aDSAzkNDkWmLN0yjTUh4BKBd+hb69jYn6qqqSg=="],
|
||||||
|
|
@ -364,7 +361,7 @@
|
||||||
|
|
||||||
"@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.2.3", "", { "os": "win32", "cpu": "x64" }, "sha512-Ibm29/GgB/ab5n7XKqlStkm54qqZE8v2FnijUPBgrd67FWrac45o/RsNlaOWjme/B5UqeWt/8KM4aWBwA1D2Kw=="],
|
"@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.2.3", "", { "os": "win32", "cpu": "x64" }, "sha512-Ibm29/GgB/ab5n7XKqlStkm54qqZE8v2FnijUPBgrd67FWrac45o/RsNlaOWjme/B5UqeWt/8KM4aWBwA1D2Kw=="],
|
||||||
|
|
||||||
"@noble/ciphers": ["@noble/ciphers@2.1.1", "", {}, "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw=="],
|
"@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
|
||||||
|
|
||||||
"@noble/curves": ["@noble/curves@1.9.7", "", { "dependencies": { "@noble/hashes": "1.8.0" } }, "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw=="],
|
"@noble/curves": ["@noble/curves@1.9.7", "", { "dependencies": { "@noble/hashes": "1.8.0" } }, "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw=="],
|
||||||
|
|
||||||
|
|
@ -386,6 +383,8 @@
|
||||||
|
|
||||||
"@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.40.0", "", {}, "sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw=="],
|
"@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.40.0", "", {}, "sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw=="],
|
||||||
|
|
||||||
|
"@playwright/test": ["@playwright/test@1.60.0", "", { "dependencies": { "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" } }, "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag=="],
|
||||||
|
|
||||||
"@prisma/client": ["@prisma/client@7.4.2", "", { "dependencies": { "@prisma/client-runtime-utils": "7.4.2" }, "peerDependencies": { "prisma": "*", "typescript": ">=5.4.0" }, "optionalPeers": ["prisma", "typescript"] }, "sha512-ts2mu+cQHriAhSxngO3StcYubBGTWDtu/4juZhXCUKOwgh26l+s4KD3vT2kMUzFyrYnll9u/3qWrtzRv9CGWzA=="],
|
"@prisma/client": ["@prisma/client@7.4.2", "", { "dependencies": { "@prisma/client-runtime-utils": "7.4.2" }, "peerDependencies": { "prisma": "*", "typescript": ">=5.4.0" }, "optionalPeers": ["prisma", "typescript"] }, "sha512-ts2mu+cQHriAhSxngO3StcYubBGTWDtu/4juZhXCUKOwgh26l+s4KD3vT2kMUzFyrYnll9u/3qWrtzRv9CGWzA=="],
|
||||||
|
|
||||||
"@prisma/client-runtime-utils": ["@prisma/client-runtime-utils@7.4.2", "", {}, "sha512-cID+rzOEb38VyMsx5LwJMEY4NGIrWCNpKu/0ImbeooQ2Px7TI+kOt7cm0NelxUzF2V41UVVXAmYjANZQtCu1/Q=="],
|
"@prisma/client-runtime-utils": ["@prisma/client-runtime-utils@7.4.2", "", {}, "sha512-cID+rzOEb38VyMsx5LwJMEY4NGIrWCNpKu/0ImbeooQ2Px7TI+kOt7cm0NelxUzF2V41UVVXAmYjANZQtCu1/Q=="],
|
||||||
|
|
@ -560,7 +559,9 @@
|
||||||
|
|
||||||
"@react-email/preview": ["@react-email/preview@0.0.14", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-aYK8q0IPkBXyMsbpMXgxazwHxYJxTrXrV95GFuu2HbEiIToMwSyUgb8HDFYwPqqfV03/jbwqlsXmFxsOd+VNaw=="],
|
"@react-email/preview": ["@react-email/preview@0.0.14", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-aYK8q0IPkBXyMsbpMXgxazwHxYJxTrXrV95GFuu2HbEiIToMwSyUgb8HDFYwPqqfV03/jbwqlsXmFxsOd+VNaw=="],
|
||||||
|
|
||||||
"@react-email/render": ["@react-email/render@2.0.6", "", { "dependencies": { "html-to-text": "^9.0.5", "prettier": "^3.5.3" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-xOzaYkH3jLZKqN5MqrTXYnmqBYUnZSVbkxdb5PGGmDcK6sKDVMliaDiSwfXajRC9JtSHTcGc2tmGLHWuCgVpog=="],
|
"@react-email/preview-server": ["@react-email/preview-server@5.2.10", "", { "dependencies": { "esbuild": "0.27.3", "next": "16.1.7" } }, "sha512-cYi21KF+Z/HGXT8RpkQMNFFubBafxyoB9Hn/wrslfDNtdoews2MdsDo6XXKkZvDTRG9SxQN3HGk4v4aoQZc20g=="],
|
||||||
|
|
||||||
|
"@react-email/render": ["@react-email/render@2.0.8", "", { "dependencies": { "html-to-text": "^9.0.5", "prettier": "^3.5.3" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-5udvVr3U/WuGJZfLdLBOhkzrqRWd2Q5ZYmF7ppcy7FzWcwgshdqLMNqJOXcVzAXJXg/2bm7D+WGJzTtZOZMQnQ=="],
|
||||||
|
|
||||||
"@react-email/row": ["@react-email/row@0.0.13", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-bYnOac40vIKCId7IkwuLAAsa3fKfSfqCvv6epJKmPE0JBuu5qI4FHFCl9o9dVpIIS08s/ub+Y/txoMt0dYziGw=="],
|
"@react-email/row": ["@react-email/row@0.0.13", "", { "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-bYnOac40vIKCId7IkwuLAAsa3fKfSfqCvv6epJKmPE0JBuu5qI4FHFCl9o9dVpIIS08s/ub+Y/txoMt0dYziGw=="],
|
||||||
|
|
||||||
|
|
@ -578,8 +579,6 @@
|
||||||
|
|
||||||
"@selderee/plugin-htmlparser2": ["@selderee/plugin-htmlparser2@0.11.0", "", { "dependencies": { "domhandler": "^5.0.3", "selderee": "^0.11.0" } }, "sha512-P33hHGdldxGabLFjPPpaTxVolMrzrcegejx+0GxjrIb9Zv48D8yAIA/QTDR2dFl7Uz7urX8aX6+5bCZslr+gWQ=="],
|
"@selderee/plugin-htmlparser2": ["@selderee/plugin-htmlparser2@0.11.0", "", { "dependencies": { "domhandler": "^5.0.3", "selderee": "^0.11.0" } }, "sha512-P33hHGdldxGabLFjPPpaTxVolMrzrcegejx+0GxjrIb9Zv48D8yAIA/QTDR2dFl7Uz7urX8aX6+5bCZslr+gWQ=="],
|
||||||
|
|
||||||
"@signalapp/libsignal-client": ["@signalapp/libsignal-client@0.92.2", "", { "dependencies": { "node-gyp-build": "^4.8.0", "type-fest": "^4.26.0" } }, "sha512-mSYKpw32Rtmm+D1y8NKzNA9wkiuU60gXRGuum6NTGRN9C3NI4R1cb6xE9w7q+6rjR4zAb4qZWb9QUG5QcLr7pg=="],
|
|
||||||
|
|
||||||
"@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
|
"@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
|
||||||
|
|
||||||
"@socket.io/component-emitter": ["@socket.io/component-emitter@3.1.2", "", {}, "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA=="],
|
"@socket.io/component-emitter": ["@socket.io/component-emitter@3.1.2", "", {}, "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA=="],
|
||||||
|
|
@ -590,39 +589,39 @@
|
||||||
|
|
||||||
"@swc/helpers": ["@swc/helpers@0.5.15", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g=="],
|
"@swc/helpers": ["@swc/helpers@0.5.15", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g=="],
|
||||||
|
|
||||||
"@tailwindcss/node": ["@tailwindcss/node@4.2.4", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.19.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.2.4" } }, "sha512-Ai7+yQPxz3ddrDQzFfBKdHEVBg0w3Zl83jnjuwxnZOsnH9pGn93QHQtpU0p/8rYWxvbFZHneni6p1BSLK4DkGA=="],
|
"@tailwindcss/node": ["@tailwindcss/node@4.3.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.21.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.0" } }, "sha512-aFb4gUhFOgdh9AXo4IzBEOzBkkAxm9VigwDJnMIYv3lcfXCJVesNfbEaBl4BNgVRyid92AmdviqwBUBRKSeY3g=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide": ["@tailwindcss/oxide@4.2.4", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.2.4", "@tailwindcss/oxide-darwin-arm64": "4.2.4", "@tailwindcss/oxide-darwin-x64": "4.2.4", "@tailwindcss/oxide-freebsd-x64": "4.2.4", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.4", "@tailwindcss/oxide-linux-arm64-gnu": "4.2.4", "@tailwindcss/oxide-linux-arm64-musl": "4.2.4", "@tailwindcss/oxide-linux-x64-gnu": "4.2.4", "@tailwindcss/oxide-linux-x64-musl": "4.2.4", "@tailwindcss/oxide-wasm32-wasi": "4.2.4", "@tailwindcss/oxide-win32-arm64-msvc": "4.2.4", "@tailwindcss/oxide-win32-x64-msvc": "4.2.4" } }, "sha512-9El/iI069DKDSXwTvB9J4BwdO5JhRrOweGaK25taBAvBXyXqJAX+Jqdvs8r8gKpsI/1m0LeJLyQYTf/WLrBT1Q=="],
|
"@tailwindcss/oxide": ["@tailwindcss/oxide@4.3.0", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.3.0", "@tailwindcss/oxide-darwin-arm64": "4.3.0", "@tailwindcss/oxide-darwin-x64": "4.3.0", "@tailwindcss/oxide-freebsd-x64": "4.3.0", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.0", "@tailwindcss/oxide-linux-arm64-gnu": "4.3.0", "@tailwindcss/oxide-linux-arm64-musl": "4.3.0", "@tailwindcss/oxide-linux-x64-gnu": "4.3.0", "@tailwindcss/oxide-linux-x64-musl": "4.3.0", "@tailwindcss/oxide-wasm32-wasi": "4.3.0", "@tailwindcss/oxide-win32-arm64-msvc": "4.3.0", "@tailwindcss/oxide-win32-x64-msvc": "4.3.0" } }, "sha512-F7HZGBeN9I0/AuuJS5PwcD8xayx5ri5GhjYUDBEVYUkexyA/giwbDNjRVrxSezE3T250OU2K/wp/ltWx3UOefg=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.2.4", "", { "os": "android", "cpu": "arm64" }, "sha512-e7MOr1SAn9U8KlZzPi1ZXGZHeC5anY36qjNwmZv9pOJ8E4Q6jmD1vyEHkQFmNOIN7twGPEMXRHmitN4zCMN03g=="],
|
"@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.3.0", "", { "os": "android", "cpu": "arm64" }, "sha512-TJPiq67tKlLuObP6RkwvVGDoxCMBVtDgKkLfa/uyj7/FyxvQwHS+UOnVrXXgbEsfUaMgiVvC4KbJnRr26ho4Ng=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.2.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tSC/Kbqpz/5/o/C2sG7QvOxAKqyd10bq+ypZNf+9Fi2TvbVbv1zNpcEptcsU7DPROaSbVgUXmrzKhurFvo5eDg=="],
|
"@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.3.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-oMN/WZRb+SO37BmUElEgeEWuU8E/HXRkiODxJxLe1UTHVXLrdVSgfaJV7pSlhRGMSOiXLuxTIjfsF3wYvz8cgQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.2.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-yPyUXn3yO/ufR6+Kzv0t4fCg2qNr90jxXc5QqBpjlPNd0NqyDXcmQb/6weunH/MEDXW5dhyEi+agTDiqa3WsGg=="],
|
"@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.3.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-N6CUmu4a6bKVADfw77p+iw6Yd9Q3OBhe0veaDX+QazfuVYlQsHfDgxBrsjQ/IW+zywL8mTrNd0SdJT/zgtvMdA=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.2.4", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BoMIB4vMQtZsXdGLVc2z+P9DbETkiopogfWZKbWwM8b/1Vinbs4YcUwo+kM/KeLkX3Ygrf4/PsRndKaYhS8Eiw=="],
|
"@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.3.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-zDL5hBkQdH5C6MpqbK3gQAgP80tsMwSI26vjOzjJtNCMUo0lFgOItzHKBIupOZNQxt3ouPH7RPhvNhiTfCe5CQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.2.4", "", { "os": "linux", "cpu": "arm" }, "sha512-7pIHBLTHYRAlS7V22JNuTh33yLH4VElwKtB3bwchK/UaKUPpQ0lPQiOWcbm4V3WP2I6fNIJ23vABIvoy2izdwA=="],
|
"@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.3.0", "", { "os": "linux", "cpu": "arm" }, "sha512-R06HdNi7A7OEoMsf6d4tjZ71RCWnZQPHj2mnotSFURjNLdBC+cIgXQ7l81CqeoiQftjf6OOblxXMInMgN2VzMA=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-+E4wxJ0ZGOzSH325reXTWB48l42i93kQqMvDyz5gqfRzRZ7faNhnmvlV4EPGJU3QJM/3Ab5jhJ5pCRUsKn6OQw=="],
|
"@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-qTJHELX8jetjhRQHCLilkVLmybpzNQAtaI/gaoVoidn/ufbNDbAo8KlK2J+yPoc8wQxvDxCmh/5lr8nC1+lTbg=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-bBADEGAbo4ASnppIziaQJelekCxdMaxisrk+fB7Thit72IBnALp9K6ffA2G4ruj90G9XRS2VQ6q2bCKbfFV82g=="],
|
"@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Z6sukiQsngnWO+l39X4pPbiWT81IC+PLKF+PHxIlyZbGNb9MODfYlXEVlFvej5BOZInWX01kVyzeLvHsXhfczQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-7Mx25E4WTfnht0TVRTyC00j3i0M+EeFe7wguMDTlX4mRxafznw0CA8WJkFjWYH5BlgELd1kSjuU2JiPnNZbJDA=="],
|
"@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-DRNdQRpSGzRGfARVuVkxvM8Q12nh19l4BF/G7zGA1oe+9wcC6saFBHTISrpIcKzhiXtSrlSrluCfvMuledoCTQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-2wwJRF7nyhOR0hhHoChc04xngV3iS+akccHTGtz965FwF0up4b2lOdo6kI1EbDaEXKgvcrFBYcYQQ/rrnWFVfA=="],
|
"@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-Z0IADbDo8bh6I7h2IQMx601AdXBLfFpEdUotft86evd/8ZPflZe9COPO8Q1vw+pfLWIUo9zN/JGZvwuAJqduqg=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.2.4", "", { "dependencies": { "@emnapi/core": "^1.8.1", "@emnapi/runtime": "^1.8.1", "@emnapi/wasi-threads": "^1.1.0", "@napi-rs/wasm-runtime": "^1.1.1", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-FQsqApeor8Fo6gUEklzmaa9994orJZZDBAlQpK2Mq+DslRKFJeD6AjHpBQ0kZFQohVr8o85PPh8eOy86VlSCmw=="],
|
"@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.3.0", "", { "dependencies": { "@emnapi/core": "^1.10.0", "@emnapi/runtime": "^1.10.0", "@emnapi/wasi-threads": "^1.2.1", "@napi-rs/wasm-runtime": "^1.1.4", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-HNZGOUxEmElksYR7S6sC5jTeNGpobAsy9u7Gu0AskJ8/20FR9GqebUyB+HBcU/ax6BHuiuJi+Oda4B+YX6H1yA=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.2.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-L9BXqxC4ToVgwMFqj3pmZRqyHEztulpUJzCxUtLjobMCzTPsGt1Fa9enKbOpY2iIyVtaHNeNvAK8ERP/64sqGQ=="],
|
"@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.3.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Pe+RPVTi1T+qymuuRpcdvwSVZjnll/f7n8gBxMMh3xLTctMDKqpdfGimbMyioqtLhUYZxdJ9wGNhV7MKHvgZsQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.2.4", "", { "os": "win32", "cpu": "x64" }, "sha512-ESlKG0EpVJQwRjXDDa9rLvhEAh0mhP1sF7sap9dNZT0yyl9SAG6T7gdP09EH0vIv0UNTlo6jPWyujD6559fZvw=="],
|
"@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.3.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Mvrf2kXW/yeW/OTezZlCGOirXRcUuLIBx/5Y12BaPM7wJoryG6dfS/NJL8aBPqtTEx/Vm4T4vKzFUcKDT+TKUA=="],
|
||||||
|
|
||||||
"@tailwindcss/postcss": ["@tailwindcss/postcss@4.2.4", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.2.4", "@tailwindcss/oxide": "4.2.4", "postcss": "^8.5.6", "tailwindcss": "4.2.4" } }, "sha512-wgAVj6nUWAolAu8YFvzT2cTBIElWHkjZwFYovF+xsqKsW2ADxM/X2opxj5NsF/qVccAOjRNe8X2IdPzMsWyHTg=="],
|
"@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.0", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.0", "@tailwindcss/oxide": "4.3.0", "postcss": "^8.5.10", "tailwindcss": "4.3.0" } }, "sha512-Jm05Tjx+9yCLGv5qw1c+84Psds8MnyrEQYCB+FFk2lgGiUjlRqdxke4mVTuYrj2xnVZqKim2Apr5ySuQRYAw/w=="],
|
||||||
|
|
||||||
"@ts-morph/common": ["@ts-morph/common@0.27.0", "", { "dependencies": { "fast-glob": "^3.3.3", "minimatch": "^10.0.1", "path-browserify": "^1.0.1" } }, "sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ=="],
|
"@ts-morph/common": ["@ts-morph/common@0.27.0", "", { "dependencies": { "fast-glob": "^3.3.3", "minimatch": "^10.0.1", "path-browserify": "^1.0.1" } }, "sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ=="],
|
||||||
|
|
||||||
"@types/bun": ["@types/bun@1.3.13", "", { "dependencies": { "bun-types": "1.3.13" } }, "sha512-9fqXWk5YIHGGnUau9TEi+qdlTYDAnOj+xLCmSTwXfAIqXr2x4tytJb43E9uCvt09zJURKXwAtkoH4nLQfzeTXw=="],
|
"@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
|
||||||
|
|
||||||
"@types/cors": ["@types/cors@2.8.19", "", { "dependencies": { "@types/node": "*" } }, "sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg=="],
|
"@types/cors": ["@types/cors@2.8.19", "", { "dependencies": { "@types/node": "*" } }, "sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg=="],
|
||||||
|
|
||||||
|
|
@ -630,7 +629,7 @@
|
||||||
|
|
||||||
"@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
|
"@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
|
||||||
|
|
||||||
"@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
|
"@types/node": ["@types/node@25.8.0", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-TCFSk8IZh+iLX1xtksoBVtdmgL+1IX0fC9BeU4QqFSuNdN/K+HUlhqOzEmSYYpZUVsLYcPqc9KX+60iDuninSQ=="],
|
||||||
|
|
||||||
"@types/nodemailer": ["@types/nodemailer@8.0.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-fyf8jWULsCo0d0BuoQ75i6IeoHs47qcqxWc7yUdUcV0pOZGjUTTOvwdG1PRXUDqN/8A64yQdQdnA2pZgcdi+cA=="],
|
"@types/nodemailer": ["@types/nodemailer@8.0.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-fyf8jWULsCo0d0BuoQ75i6IeoHs47qcqxWc7yUdUcV0pOZGjUTTOvwdG1PRXUDqN/8A64yQdQdnA2pZgcdi+cA=="],
|
||||||
|
|
||||||
|
|
@ -666,7 +665,7 @@
|
||||||
|
|
||||||
"atomically": ["atomically@2.1.1", "", { "dependencies": { "stubborn-fs": "^2.0.0", "when-exit": "^2.1.4" } }, "sha512-P4w9o2dqARji6P7MHprklbfiArZAWvo07yW7qs3pdljb3BWr12FIB7W+p0zJiuiVsUpRO0iZn1kFFcpPegg0tQ=="],
|
"atomically": ["atomically@2.1.1", "", { "dependencies": { "stubborn-fs": "^2.0.0", "when-exit": "^2.1.4" } }, "sha512-P4w9o2dqARji6P7MHprklbfiArZAWvo07yW7qs3pdljb3BWr12FIB7W+p0zJiuiVsUpRO0iZn1kFFcpPegg0tQ=="],
|
||||||
|
|
||||||
"auth": ["auth@1.6.9", "", { "dependencies": { "@babel/core": "^7.29.0", "@babel/preset-react": "^7.28.5", "@babel/preset-typescript": "^7.28.5", "@better-auth/core": "1.6.9", "@better-auth/telemetry": "1.6.9", "@better-auth/utils": "0.4.0", "@clack/prompts": "^0.11.0", "@mrleebo/prisma-ast": "^0.13.1", "better-auth": "1.6.9", "c12": "^3.3.3", "chalk": "^5.6.2", "commander": "^12.1.0", "dotenv": "^17.3.1", "get-tsconfig": "^4.13.6", "open": "^10.2.0", "prettier": "^3.8.1", "prompts": "^2.4.2", "semver": "^7.7.4", "yocto-spinner": "^0.2.3", "zod": "^4.3.6" }, "bin": { "better-auth": "dist/index.mjs", "auth": "dist/index.mjs" } }, "sha512-VWsOu2QiUkJxuvhG+yth6oVpZWntjyYJTZd5CE1kHEVrRXKpAGeH1MKVlD5OpzGEveBrY9W2GLlYji3uYozLIw=="],
|
"auth": ["auth@1.6.11", "", { "dependencies": { "@babel/core": "^7.29.0", "@babel/preset-react": "^7.28.5", "@babel/preset-typescript": "^7.28.5", "@better-auth/core": "1.6.11", "@better-auth/telemetry": "1.6.11", "@better-auth/utils": "0.4.0", "@clack/prompts": "^0.11.0", "@mrleebo/prisma-ast": "^0.13.1", "better-auth": "1.6.11", "c12": "^3.3.3", "chalk": "^5.6.2", "commander": "^12.1.0", "dotenv": "^17.3.1", "get-tsconfig": "^4.13.6", "open": "^10.2.0", "prettier": "^3.8.1", "prompts": "^2.4.2", "semver": "^7.7.4", "yocto-spinner": "^0.2.3", "zod": "^4.3.6" }, "bin": { "better-auth": "dist/index.mjs", "auth": "dist/index.mjs" } }, "sha512-SyQZAU37AosE8koF0fBsDob9+Q7AvdAA1YFblg/5DkhwdiaHGIACjDZTJJq8cEWjkLAszDcAc0kC2DSr1xZ8wg=="],
|
||||||
|
|
||||||
"aws-ssl-profiles": ["aws-ssl-profiles@1.1.2", "", {}, "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g=="],
|
"aws-ssl-profiles": ["aws-ssl-profiles@1.1.2", "", {}, "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g=="],
|
||||||
|
|
||||||
|
|
@ -674,13 +673,11 @@
|
||||||
|
|
||||||
"balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
|
"balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
|
||||||
|
|
||||||
"base58-js": ["base58-js@3.0.3", "", {}, "sha512-3hf42BysHnUqmZO7mK6e5X/hs1AvyEJIhdVLbG/Mxn/fhFnhGxOO37mWbMHg1RT4TxqcPKXgqj9/bp1YG0GBXA=="],
|
|
||||||
|
|
||||||
"base64id": ["base64id@2.0.0", "", {}, "sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog=="],
|
"base64id": ["base64id@2.0.0", "", {}, "sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog=="],
|
||||||
|
|
||||||
"baseline-browser-mapping": ["baseline-browser-mapping@2.10.0", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA=="],
|
"baseline-browser-mapping": ["baseline-browser-mapping@2.10.0", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA=="],
|
||||||
|
|
||||||
"better-auth": ["better-auth@1.6.9", "", { "dependencies": { "@better-auth/core": "1.6.9", "@better-auth/drizzle-adapter": "1.6.9", "@better-auth/kysely-adapter": "1.6.9", "@better-auth/memory-adapter": "1.6.9", "@better-auth/mongo-adapter": "1.6.9", "@better-auth/prisma-adapter": "1.6.9", "@better-auth/telemetry": "1.6.9", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.5", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.14", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-EBFURtglyiEZxbx4NJBoqUD8J65dX24yC+6I9AUbIXNgUkt76mshzGbHkxZ3n/lB7Dwq3kBC+hHt0hUQsnL7HA=="],
|
"better-auth": ["better-auth@1.6.11", "", { "dependencies": { "@better-auth/core": "1.6.11", "@better-auth/drizzle-adapter": "1.6.11", "@better-auth/kysely-adapter": "1.6.11", "@better-auth/memory-adapter": "1.6.11", "@better-auth/mongo-adapter": "1.6.11", "@better-auth/prisma-adapter": "1.6.11", "@better-auth/telemetry": "1.6.11", "@better-auth/utils": "0.4.0", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.5", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-Wwt6+q07dwIhsp6XiM7L1qSXVUWBEtNl+eZvwM778CguFqDZFBN9Pt6LtFaHl55t8Z+Zc//5kxcbgDY8/79vFQ=="],
|
||||||
|
|
||||||
"better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="],
|
"better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="],
|
||||||
|
|
||||||
|
|
@ -700,9 +697,9 @@
|
||||||
|
|
||||||
"buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
|
"buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
|
||||||
|
|
||||||
"bullmq": ["bullmq@5.76.5", "", { "dependencies": { "cron-parser": "4.9.0", "ioredis": "5.10.1", "msgpackr": "1.11.12", "node-abort-controller": "3.1.1", "semver": "7.7.4", "tslib": "2.8.1" } }, "sha512-2OKJP2+ckc+TygsWdxxeZYYgM9xYnVXgIAx+perflhamZ6FEBu/cSrvpqM8++fJI5OgsIFLfxA9UO7BDZ74Inw=="],
|
"bullmq": ["bullmq@5.76.10", "", { "dependencies": { "cron-parser": "4.9.0", "ioredis": "5.10.1", "msgpackr": "2.0.1", "node-abort-controller": "3.1.1", "semver": "7.8.0", "tslib": "2.8.1" } }, "sha512-LWve7SpQjYSpCP2GEsWmoyzTz2H37L8HRmSTu3YihYsTOr5kJxrfEX6aEV7m6eskEMWXSHZYTMZepX6qNaH6CQ=="],
|
||||||
|
|
||||||
"bun-types": ["bun-types@1.3.13", "", { "dependencies": { "@types/node": "*" } }, "sha512-QXKeHLlOLqQX9LgYaHJfzdBaV21T63HhFJnvuRCcjZiaUDpbs5ED1MgxbMra71CsryN/1dAoXuJJJwIv/2drVA=="],
|
"bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
|
||||||
|
|
||||||
"bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
|
"bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
|
||||||
|
|
||||||
|
|
@ -816,8 +813,6 @@
|
||||||
|
|
||||||
"dexie": ["dexie@4.4.2", "", {}, "sha512-zMtV8q79EFE5U8FKZvt0Y/77PCU/Hr/RDxv1EDeo228L+m/HTbeN2AjoQm674rhQCX8n3ljK87lajt7UQuZfvw=="],
|
"dexie": ["dexie@4.4.2", "", {}, "sha512-zMtV8q79EFE5U8FKZvt0Y/77PCU/Hr/RDxv1EDeo228L+m/HTbeN2AjoQm674rhQCX8n3ljK87lajt7UQuZfvw=="],
|
||||||
|
|
||||||
"dexie-react-hooks": ["dexie-react-hooks@4.4.0", "", { "peerDependencies": { "dexie": ">=4.2.0-alpha.1 <5.0.0", "react": ">=16" } }, "sha512-ObLXBS5+4BJU8vtSvBx6b9fY6zZYgniAtwxzjCHsUQadgbqYN6935X2/1TWw4Rf2N1aZV1io5/ziox4vKuxABA=="],
|
|
||||||
|
|
||||||
"diff": ["diff@8.0.3", "", {}, "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ=="],
|
"diff": ["diff@8.0.3", "", {}, "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ=="],
|
||||||
|
|
||||||
"dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
|
"dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
|
||||||
|
|
@ -854,11 +849,9 @@
|
||||||
|
|
||||||
"engine.io": ["engine.io@6.6.5", "", { "dependencies": { "@types/cors": "^2.8.12", "@types/node": ">=10.0.0", "accepts": "~1.3.4", "base64id": "2.0.0", "cookie": "~0.7.2", "cors": "~2.8.5", "debug": "~4.4.1", "engine.io-parser": "~5.2.1", "ws": "~8.18.3" } }, "sha512-2RZdgEbXmp5+dVbRm0P7HQUImZpICccJy7rN7Tv+SFa55pH+lxnuw6/K1ZxxBfHoYpSkHLAO92oa8O4SwFXA2A=="],
|
"engine.io": ["engine.io@6.6.5", "", { "dependencies": { "@types/cors": "^2.8.12", "@types/node": ">=10.0.0", "accepts": "~1.3.4", "base64id": "2.0.0", "cookie": "~0.7.2", "cors": "~2.8.5", "debug": "~4.4.1", "engine.io-parser": "~5.2.1", "ws": "~8.18.3" } }, "sha512-2RZdgEbXmp5+dVbRm0P7HQUImZpICccJy7rN7Tv+SFa55pH+lxnuw6/K1ZxxBfHoYpSkHLAO92oa8O4SwFXA2A=="],
|
||||||
|
|
||||||
"engine.io-client": ["engine.io-client@6.6.4", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1", "engine.io-parser": "~5.2.1", "ws": "~8.18.3", "xmlhttprequest-ssl": "~2.1.1" } }, "sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw=="],
|
|
||||||
|
|
||||||
"engine.io-parser": ["engine.io-parser@5.2.3", "", {}, "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q=="],
|
"engine.io-parser": ["engine.io-parser@5.2.3", "", {}, "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q=="],
|
||||||
|
|
||||||
"enhanced-resolve": ["enhanced-resolve@5.20.0", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-/ce7+jQ1PQ6rVXwe+jKEg5hW5ciicHwIQUagZkp6IufBoY3YDgdTTY1azVs0qoRgVmvsNB+rbjLJxDAeHHtwsQ=="],
|
"enhanced-resolve": ["enhanced-resolve@5.21.3", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-QyL119InA+XXEkNLNTPCXPugSvOfhwv0JOlGNzvxs0hZaiHLNvXSpudUWsOlsXGWJh8G6ckCScEkVHfX3kw/2Q=="],
|
||||||
|
|
||||||
"entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
|
"entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
|
||||||
|
|
||||||
|
|
@ -872,7 +865,7 @@
|
||||||
|
|
||||||
"es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
|
"es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="],
|
||||||
|
|
||||||
"esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
|
"esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="],
|
||||||
|
|
||||||
"escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
|
"escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
|
||||||
|
|
||||||
|
|
@ -1074,7 +1067,7 @@
|
||||||
|
|
||||||
"kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
|
"kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
|
||||||
|
|
||||||
"kysely": ["kysely@0.28.14", "", {}, "sha512-SU3lgh0rPvq7upc6vvdVrCsSMUG1h3ChvHVOY7wJ2fw4C9QEB7X3d5eyYEyULUX7UQtxZJtZXGuT6U2US72UYA=="],
|
"kysely": ["kysely@0.28.17", "", {}, "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q=="],
|
||||||
|
|
||||||
"leac": ["leac@0.6.0", "", {}, "sha512-y+SqErxb8h7nE/fiEX07jsbuhrpO9lL8eca7/Y1nuWV2moNlXhyd59iDGcRf6moVyDMbmTNzL40SUyrFU/yDpg=="],
|
"leac": ["leac@0.6.0", "", {}, "sha512-y+SqErxb8h7nE/fiEX07jsbuhrpO9lL8eca7/Y1nuWV2moNlXhyd59iDGcRf6moVyDMbmTNzL40SUyrFU/yDpg=="],
|
||||||
|
|
||||||
|
|
@ -1120,7 +1113,7 @@
|
||||||
|
|
||||||
"lru.min": ["lru.min@1.1.4", "", {}, "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA=="],
|
"lru.min": ["lru.min@1.1.4", "", {}, "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA=="],
|
||||||
|
|
||||||
"lucide-react": ["lucide-react@1.14.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-+1mdWcfSJVUsaTIjN9zoezmUhfXo5l0vP7ekBMPo3jcS/aIkxHnXqAPsByszMZx/Y8oQBRJxJx5xg+RH3urzxA=="],
|
"lucide-react": ["lucide-react@1.16.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-dYwyPzb4MEKpGUmNYk3WKWPnMrHs3FKM+q94kAnJrcDIqqn1hq2xY8scaS2ovsOCM5D51ey2gaRG3PBb1vgoYQ=="],
|
||||||
|
|
||||||
"luxon": ["luxon@3.7.2", "", {}, "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew=="],
|
"luxon": ["luxon@3.7.2", "", {}, "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew=="],
|
||||||
|
|
||||||
|
|
@ -1162,7 +1155,7 @@
|
||||||
|
|
||||||
"ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
|
"ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
|
||||||
|
|
||||||
"msgpackr": ["msgpackr@1.11.12", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.2" } }, "sha512-RBdJ1Un7yGlXWajrkxcSa93nvQ0w4zBf60c0yYv7YtBelP8H2FA7XsfBbMHtXKXUMUxH7zV3Zuozh+kUQWhHvg=="],
|
"msgpackr": ["msgpackr@2.0.1", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.2" } }, "sha512-9J+tqTEsbHqY8YohazYgty7LgerFIWxvMLpUjqETSmjHojtJm2WnX2kK/2a1fLI7CO7ERP1YSEUXMucz4j+yBA=="],
|
||||||
|
|
||||||
"msgpackr-extract": ["msgpackr-extract@3.0.3", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA=="],
|
"msgpackr-extract": ["msgpackr-extract@3.0.3", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA=="],
|
||||||
|
|
||||||
|
|
@ -1192,8 +1185,6 @@
|
||||||
|
|
||||||
"node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
|
"node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
|
||||||
|
|
||||||
"node-gyp-build": ["node-gyp-build@4.8.4", "", { "bin": { "node-gyp-build": "bin.js", "node-gyp-build-optional": "optional.js", "node-gyp-build-test": "build-test.js" } }, "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ=="],
|
|
||||||
|
|
||||||
"node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
|
"node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
|
||||||
|
|
||||||
"node-releases": ["node-releases@2.0.36", "", {}, "sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA=="],
|
"node-releases": ["node-releases@2.0.36", "", {}, "sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA=="],
|
||||||
|
|
@ -1252,15 +1243,15 @@
|
||||||
|
|
||||||
"perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
|
"perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
|
||||||
|
|
||||||
"pg": ["pg@8.20.0", "", { "dependencies": { "pg-connection-string": "^2.12.0", "pg-pool": "^3.13.0", "pg-protocol": "^1.13.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.3.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA=="],
|
"pg": ["pg@8.21.0", "", { "dependencies": { "pg-connection-string": "^2.13.0", "pg-pool": "^3.14.0", "pg-protocol": "^1.14.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.4.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA=="],
|
||||||
|
|
||||||
"pg-cloudflare": ["pg-cloudflare@1.3.0", "", {}, "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ=="],
|
"pg-cloudflare": ["pg-cloudflare@1.4.0", "", {}, "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A=="],
|
||||||
|
|
||||||
"pg-connection-string": ["pg-connection-string@2.12.0", "", {}, "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ=="],
|
"pg-connection-string": ["pg-connection-string@2.13.0", "", {}, "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig=="],
|
||||||
|
|
||||||
"pg-int8": ["pg-int8@1.0.1", "", {}, "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="],
|
"pg-int8": ["pg-int8@1.0.1", "", {}, "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="],
|
||||||
|
|
||||||
"pg-pool": ["pg-pool@3.13.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gB+R+Xud1gLFuRD/QgOIgGOBE2KCQPaPwkzBBGC9oG69pHTkhQeIuejVIk3/cnDyX39av2AxomQiyPT13WKHQA=="],
|
"pg-pool": ["pg-pool@3.14.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw=="],
|
||||||
|
|
||||||
"pg-protocol": ["pg-protocol@1.13.0", "", {}, "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w=="],
|
"pg-protocol": ["pg-protocol@1.13.0", "", {}, "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w=="],
|
||||||
|
|
||||||
|
|
@ -1276,7 +1267,11 @@
|
||||||
|
|
||||||
"pkg-types": ["pkg-types@2.3.0", "", { "dependencies": { "confbox": "^0.2.2", "exsolve": "^1.0.7", "pathe": "^2.0.3" } }, "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig=="],
|
"pkg-types": ["pkg-types@2.3.0", "", { "dependencies": { "confbox": "^0.2.2", "exsolve": "^1.0.7", "pathe": "^2.0.3" } }, "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig=="],
|
||||||
|
|
||||||
"postcss": ["postcss@8.5.8", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg=="],
|
"playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="],
|
||||||
|
|
||||||
|
"playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="],
|
||||||
|
|
||||||
|
"postcss": ["postcss@8.5.14", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg=="],
|
||||||
|
|
||||||
"postcss-selector-parser": ["postcss-selector-parser@7.1.1", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg=="],
|
"postcss-selector-parser": ["postcss-selector-parser@7.1.1", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg=="],
|
||||||
|
|
||||||
|
|
@ -1328,7 +1323,7 @@
|
||||||
|
|
||||||
"react-email": ["react-email@5.2.10", "", { "dependencies": { "@babel/parser": "7.27.0", "@babel/traverse": "7.27.0", "chokidar": "^4.0.3", "commander": "^13.0.0", "conf": "^15.0.2", "debounce": "^2.0.0", "esbuild": "0.27.3", "glob": "^13.0.6", "jiti": "2.4.2", "log-symbols": "^7.0.0", "mime-types": "^3.0.0", "normalize-path": "^3.0.0", "nypm": "0.6.2", "ora": "^8.0.0", "prompts": "2.4.2", "socket.io": "^4.8.1", "tsconfig-paths": "4.2.0" }, "bin": { "email": "dist/index.mjs" } }, "sha512-Ys8yR5/a0nXf5u2GlT2UV93PJHC3ZnuMnNebEn7I5UE9XfMFPtlpgDs02mPJOJn49fhJjDTWIUlZD1vmQPDgJg=="],
|
"react-email": ["react-email@5.2.10", "", { "dependencies": { "@babel/parser": "7.27.0", "@babel/traverse": "7.27.0", "chokidar": "^4.0.3", "commander": "^13.0.0", "conf": "^15.0.2", "debounce": "^2.0.0", "esbuild": "0.27.3", "glob": "^13.0.6", "jiti": "2.4.2", "log-symbols": "^7.0.0", "mime-types": "^3.0.0", "normalize-path": "^3.0.0", "nypm": "0.6.2", "ora": "^8.0.0", "prompts": "2.4.2", "socket.io": "^4.8.1", "tsconfig-paths": "4.2.0" }, "bin": { "email": "dist/index.mjs" } }, "sha512-Ys8yR5/a0nXf5u2GlT2UV93PJHC3ZnuMnNebEn7I5UE9XfMFPtlpgDs02mPJOJn49fhJjDTWIUlZD1vmQPDgJg=="],
|
||||||
|
|
||||||
"react-hook-form": ["react-hook-form@7.75.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17 || ^18 || ^19" } }, "sha512-Ovv94H+0p3sJ7B9B5QxPuCP1u8V/cHuVGyH55cSwodYDtoJwK+fqk3vjfIgSX59I2U/bU4z0nRJ9HMLpNiWEmw=="],
|
"react-hook-form": ["react-hook-form@7.76.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17 || ^18 || ^19" } }, "sha512-eKtLGgFeSgkHqQD8J59AMZ9a4uD1D83iSIzt4YlTGD7liDen5rrjcUO1rVIGd9yC1gofryjtHbv+4ny4hkLWlw=="],
|
||||||
|
|
||||||
"react-remove-scroll": ["react-remove-scroll@2.7.2", "", { "dependencies": { "react-remove-scroll-bar": "^2.3.7", "react-style-singleton": "^2.2.3", "tslib": "^2.1.0", "use-callback-ref": "^1.3.3", "use-sidecar": "^1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q=="],
|
"react-remove-scroll": ["react-remove-scroll@2.7.2", "", { "dependencies": { "react-remove-scroll-bar": "^2.3.7", "react-style-singleton": "^2.2.3", "tslib": "^2.1.0", "use-callback-ref": "^1.3.3", "use-sidecar": "^1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q=="],
|
||||||
|
|
||||||
|
|
@ -1420,8 +1415,6 @@
|
||||||
|
|
||||||
"socket.io-adapter": ["socket.io-adapter@2.5.6", "", { "dependencies": { "debug": "~4.4.1", "ws": "~8.18.3" } }, "sha512-DkkO/dz7MGln0dHn5bmN3pPy+JmywNICWrJqVWiVOyvXjWQFIv9c2h24JrQLLFJ2aQVQf/Cvl1vblnd4r2apLQ=="],
|
"socket.io-adapter": ["socket.io-adapter@2.5.6", "", { "dependencies": { "debug": "~4.4.1", "ws": "~8.18.3" } }, "sha512-DkkO/dz7MGln0dHn5bmN3pPy+JmywNICWrJqVWiVOyvXjWQFIv9c2h24JrQLLFJ2aQVQf/Cvl1vblnd4r2apLQ=="],
|
||||||
|
|
||||||
"socket.io-client": ["socket.io-client@4.8.3", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1", "engine.io-client": "~6.6.1", "socket.io-parser": "~4.2.4" } }, "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g=="],
|
|
||||||
|
|
||||||
"socket.io-parser": ["socket.io-parser@4.2.5", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1" } }, "sha512-bPMmpy/5WWKHea5Y/jYAP6k74A+hvmRCQaJuJB6I/ML5JZq/KfNieUVo/3Mh7SAqn7TyFdIo6wqYHInG1MU1bQ=="],
|
"socket.io-parser": ["socket.io-parser@4.2.5", "", { "dependencies": { "@socket.io/component-emitter": "~3.1.0", "debug": "~4.4.1" } }, "sha512-bPMmpy/5WWKHea5Y/jYAP6k74A+hvmRCQaJuJB6I/ML5JZq/KfNieUVo/3Mh7SAqn7TyFdIo6wqYHInG1MU1bQ=="],
|
||||||
|
|
||||||
"sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
|
"sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
|
||||||
|
|
@ -1476,11 +1469,11 @@
|
||||||
|
|
||||||
"tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
|
"tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
|
||||||
|
|
||||||
"tailwind-merge": ["tailwind-merge@3.5.0", "", {}, "sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A=="],
|
"tailwind-merge": ["tailwind-merge@3.6.0", "", {}, "sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w=="],
|
||||||
|
|
||||||
"tailwindcss": ["tailwindcss@4.2.4", "", {}, "sha512-HhKppgO81FQof5m6TEnuBWCZGgfRAWbaeOaGT00KOy/Pf/j6oUihdvBpA7ltCeAvZpFhW3j0PTclkxsd4IXYDA=="],
|
"tailwindcss": ["tailwindcss@4.3.0", "", {}, "sha512-y6nxMGB1nMW9R6k96e5gdIFzcfL/gTJRNaqGes1YvkLnPVXzWgbqFF2yLC0T8G774n24cx3Pe8XrKoniCOAH+Q=="],
|
||||||
|
|
||||||
"tapable": ["tapable@2.3.0", "", {}, "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg=="],
|
"tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
|
||||||
|
|
||||||
"through2": ["through2@4.0.2", "", { "dependencies": { "readable-stream": "3" } }, "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw=="],
|
"through2": ["through2@4.0.2", "", { "dependencies": { "readable-stream": "3" } }, "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw=="],
|
||||||
|
|
||||||
|
|
@ -1504,15 +1497,13 @@
|
||||||
|
|
||||||
"tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
|
"tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
|
||||||
|
|
||||||
"tsx": ["tsx@4.21.0", "", { "dependencies": { "esbuild": "~0.27.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw=="],
|
"tsx": ["tsx@4.22.1", "", { "dependencies": { "esbuild": "~0.28.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-TvncJykhxAzFCk0VQZKBTClall4Pm7qXDSodb6uxi8QFa8X8mT6ABjxxsQ2opDRYxG7AzcRWXaFtruz5HJKuWg=="],
|
||||||
|
|
||||||
"tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],
|
"tw-animate-css": ["tw-animate-css@1.4.0", "", {}, "sha512-7bziOlRqH0hJx80h/3mbicLW7o8qLsH5+RaLR2t+OHM3D0JlWGODQKQ4cxbK7WlvmUxpcj6Kgu6EKqjrGFe3QQ=="],
|
||||||
|
|
||||||
"tweetnacl": ["tweetnacl@1.0.3", "", {}, "sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw=="],
|
"tweetnacl": ["tweetnacl@1.0.3", "", {}, "sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw=="],
|
||||||
|
|
||||||
"tweetnacl-util": ["tweetnacl-util@0.15.1", "", {}, "sha512-RKJBIj8lySrShN4w6i/BonWp2Z/uxwC3h4y7xsRrpP59ZboCd0GpEVsOnMDYLMmKBpYhb5TgHzZXy7wTfYFBRw=="],
|
"type-fest": ["type-fest@5.4.4", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-JnTrzGu+zPV3aXIUhnyWJj4z/wigMsdYajGLIYakqyOW1nPllzXEJee0QQbHj+CTIQtXGlAjuK0UY+2xTyjVAw=="],
|
||||||
|
|
||||||
"type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],
|
|
||||||
|
|
||||||
"type-is": ["type-is@2.0.1", "", { "dependencies": { "content-type": "^1.0.5", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw=="],
|
"type-is": ["type-is@2.0.1", "", { "dependencies": { "content-type": "^1.0.5", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw=="],
|
||||||
|
|
||||||
|
|
@ -1520,7 +1511,7 @@
|
||||||
|
|
||||||
"uint8array-extras": ["uint8array-extras@1.5.0", "", {}, "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A=="],
|
"uint8array-extras": ["uint8array-extras@1.5.0", "", {}, "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A=="],
|
||||||
|
|
||||||
"undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
|
"undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="],
|
||||||
|
|
||||||
"unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="],
|
"unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="],
|
||||||
|
|
||||||
|
|
@ -1566,8 +1557,6 @@
|
||||||
|
|
||||||
"xmlbuilder": ["xmlbuilder@11.0.1", "", {}, "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA=="],
|
"xmlbuilder": ["xmlbuilder@11.0.1", "", {}, "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA=="],
|
||||||
|
|
||||||
"xmlhttprequest-ssl": ["xmlhttprequest-ssl@2.1.2", "", {}, "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ=="],
|
|
||||||
|
|
||||||
"xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
|
"xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
|
||||||
|
|
||||||
"y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
|
"y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
|
||||||
|
|
@ -1618,8 +1607,6 @@
|
||||||
|
|
||||||
"@babel/traverse/@babel/parser": ["@babel/parser@7.29.0", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww=="],
|
"@babel/traverse/@babel/parser": ["@babel/parser@7.29.0", "", { "dependencies": { "@babel/types": "^7.29.0" }, "bin": "./bin/babel-parser.js" }, "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww=="],
|
||||||
|
|
||||||
"@better-auth/core/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
|
|
||||||
|
|
||||||
"@better-auth/utils/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
|
"@better-auth/utils/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
|
||||||
|
|
||||||
"@dotenvx/dotenvx/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
|
"@dotenvx/dotenvx/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
|
||||||
|
|
@ -1630,8 +1617,6 @@
|
||||||
|
|
||||||
"@dotenvx/dotenvx/which": ["which@4.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg=="],
|
"@dotenvx/dotenvx/which": ["which@4.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg=="],
|
||||||
|
|
||||||
"@ecies/ciphers/@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
|
|
||||||
|
|
||||||
"@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],
|
"@esbuild-kit/core-utils/esbuild": ["esbuild@0.18.20", "", { "optionalDependencies": { "@esbuild/android-arm": "0.18.20", "@esbuild/android-arm64": "0.18.20", "@esbuild/android-x64": "0.18.20", "@esbuild/darwin-arm64": "0.18.20", "@esbuild/darwin-x64": "0.18.20", "@esbuild/freebsd-arm64": "0.18.20", "@esbuild/freebsd-x64": "0.18.20", "@esbuild/linux-arm": "0.18.20", "@esbuild/linux-arm64": "0.18.20", "@esbuild/linux-ia32": "0.18.20", "@esbuild/linux-loong64": "0.18.20", "@esbuild/linux-mips64el": "0.18.20", "@esbuild/linux-ppc64": "0.18.20", "@esbuild/linux-riscv64": "0.18.20", "@esbuild/linux-s390x": "0.18.20", "@esbuild/linux-x64": "0.18.20", "@esbuild/netbsd-x64": "0.18.20", "@esbuild/openbsd-x64": "0.18.20", "@esbuild/sunos-x64": "0.18.20", "@esbuild/win32-arm64": "0.18.20", "@esbuild/win32-ia32": "0.18.20", "@esbuild/win32-x64": "0.18.20" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA=="],
|
||||||
|
|
||||||
"@modelcontextprotocol/sdk/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
|
"@modelcontextprotocol/sdk/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
|
||||||
|
|
@ -1646,17 +1631,21 @@
|
||||||
|
|
||||||
"@prisma/get-platform/@prisma/debug": ["@prisma/debug@7.2.0", "", {}, "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw=="],
|
"@prisma/get-platform/@prisma/debug": ["@prisma/debug@7.2.0", "", {}, "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw=="],
|
||||||
|
|
||||||
|
"@react-email/components/@react-email/render": ["@react-email/render@2.0.6", "", { "dependencies": { "html-to-text": "^9.0.5", "prettier": "^3.5.3" }, "peerDependencies": { "react": "^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^18.0 || ^19.0 || ^19.0.0-rc" } }, "sha512-xOzaYkH3jLZKqN5MqrTXYnmqBYUnZSVbkxdb5PGGmDcK6sKDVMliaDiSwfXajRC9JtSHTcGc2tmGLHWuCgVpog=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next": ["next@16.1.7", "", { "dependencies": { "@next/env": "16.1.7", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.4.31", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.1.7", "@next/swc-darwin-x64": "16.1.7", "@next/swc-linux-arm64-gnu": "16.1.7", "@next/swc-linux-arm64-musl": "16.1.7", "@next/swc-linux-x64-gnu": "16.1.7", "@next/swc-linux-x64-musl": "16.1.7", "@next/swc-win32-arm64-msvc": "16.1.7", "@next/swc-win32-x64-msvc": "16.1.7", "sharp": "^0.34.4" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-WM0L7WrSvKwoLegLYr6V+mz+RIofqQgVAfHhMp9a88ms0cFX8iX9ew+snpWlSBwpkURJOUdvCEt3uLl3NNzvWg=="],
|
||||||
|
|
||||||
"@react-email/tailwind/tailwindcss": ["tailwindcss@4.2.2", "", {}, "sha512-KWBIxs1Xb6NoLdMVqhbhgwZf2PGBpPEiwOqgI4pFIYbNTfBXiKYyWoTsXgBQ9WFg/OlhnvHaY+AEpW7wSmFo2Q=="],
|
"@react-email/tailwind/tailwindcss": ["tailwindcss@4.2.2", "", {}, "sha512-KWBIxs1Xb6NoLdMVqhbhgwZf2PGBpPEiwOqgI4pFIYbNTfBXiKYyWoTsXgBQ9WFg/OlhnvHaY+AEpW7wSmFo2Q=="],
|
||||||
|
|
||||||
"@tailwindcss/node/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
|
"@tailwindcss/node/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.8.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.1.0", "tslib": "^2.4.0" }, "bundled": true }, "sha512-AvT9QFpxK0Zd8J0jopedNm+w/2fIzvtPKPjqyw9jwvBaReTTqPBk9Hixaz7KbjimP+QNz605/XnjFcDAL2pqBg=="],
|
"@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.8.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg=="],
|
"@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.1.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ=="],
|
"@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.1", "", { "dependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1", "@tybys/wasm-util": "^0.10.1" }, "bundled": true }, "sha512-p64ah1M1ld8xjWv3qbvFwHiFVWrq1yFvV4f7w+mzaqiR4IlSgkqhcRdHwsGgomwzBH51sRY4NEowLxnaBjcW/A=="],
|
"@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
|
||||||
|
|
||||||
"@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
|
"@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg=="],
|
||||||
|
|
||||||
|
|
@ -1670,11 +1659,9 @@
|
||||||
|
|
||||||
"accepts/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
|
"accepts/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
|
||||||
|
|
||||||
"auth/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
|
"better-auth/@noble/ciphers": ["@noble/ciphers@2.1.1", "", {}, "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw=="],
|
||||||
|
|
||||||
"better-auth/@noble/hashes": ["@noble/hashes@2.0.1", "", {}, "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw=="],
|
"bullmq/semver": ["semver@7.8.0", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA=="],
|
||||||
|
|
||||||
"better-auth/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
|
|
||||||
|
|
||||||
"c12/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
|
"c12/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
|
||||||
|
|
||||||
|
|
@ -1690,7 +1677,9 @@
|
||||||
|
|
||||||
"cosmiconfig/env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="],
|
"cosmiconfig/env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="],
|
||||||
|
|
||||||
"dot-prop/type-fest": ["type-fest@5.4.4", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-JnTrzGu+zPV3aXIUhnyWJj4z/wigMsdYajGLIYakqyOW1nPllzXEJee0QQbHj+CTIQtXGlAjuK0UY+2xTyjVAw=="],
|
"drizzle-kit/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/tsx": ["tsx@4.21.0", "", { "dependencies": { "esbuild": "~0.27.0", "get-tsconfig": "^4.7.5" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw=="],
|
||||||
|
|
||||||
"eciesjs/@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
|
"eciesjs/@noble/ciphers": ["@noble/ciphers@1.3.0", "", {}, "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw=="],
|
||||||
|
|
||||||
|
|
@ -1710,8 +1699,6 @@
|
||||||
|
|
||||||
"minio/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
|
"minio/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
|
||||||
|
|
||||||
"msw/type-fest": ["type-fest@5.4.4", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-JnTrzGu+zPV3aXIUhnyWJj4z/wigMsdYajGLIYakqyOW1nPllzXEJee0QQbHj+CTIQtXGlAjuK0UY+2xTyjVAw=="],
|
|
||||||
|
|
||||||
"next/postcss": ["postcss@8.4.31", "", { "dependencies": { "nanoid": "^3.3.6", "picocolors": "^1.0.0", "source-map-js": "^1.0.2" } }, "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ=="],
|
"next/postcss": ["postcss@8.4.31", "", { "dependencies": { "nanoid": "^3.3.6", "picocolors": "^1.0.0", "source-map-js": "^1.0.2" } }, "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ=="],
|
||||||
|
|
||||||
"npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
|
"npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
|
||||||
|
|
@ -1720,6 +1707,10 @@
|
||||||
|
|
||||||
"path-scurry/lru-cache": ["lru-cache@11.2.6", "", {}, "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ=="],
|
"path-scurry/lru-cache": ["lru-cache@11.2.6", "", {}, "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ=="],
|
||||||
|
|
||||||
|
"pg/pg-protocol": ["pg-protocol@1.14.0", "", {}, "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA=="],
|
||||||
|
|
||||||
|
"playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
|
||||||
|
|
||||||
"prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
|
"prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
|
||||||
|
|
||||||
"proper-lockfile/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
|
"proper-lockfile/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
|
||||||
|
|
@ -1728,8 +1719,6 @@
|
||||||
|
|
||||||
"react-email/commander": ["commander@13.1.0", "", {}, "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw=="],
|
"react-email/commander": ["commander@13.1.0", "", {}, "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw=="],
|
||||||
|
|
||||||
"react-email/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="],
|
|
||||||
|
|
||||||
"restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
|
"restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
|
||||||
|
|
||||||
"router/path-to-regexp": ["path-to-regexp@8.3.0", "", {}, "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA=="],
|
"router/path-to-regexp": ["path-to-regexp@8.3.0", "", {}, "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA=="],
|
||||||
|
|
@ -1740,9 +1729,13 @@
|
||||||
|
|
||||||
"shadcn/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
|
"shadcn/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
|
||||||
|
|
||||||
|
"shadcn/postcss": ["postcss@8.5.8", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg=="],
|
||||||
|
|
||||||
|
"shadcn/tailwind-merge": ["tailwind-merge@3.5.0", "", {}, "sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A=="],
|
||||||
|
|
||||||
"shadcn/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
|
"shadcn/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
|
||||||
|
|
||||||
"tsx/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="],
|
"tsx/esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
|
||||||
|
|
||||||
"wrap-ansi/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
|
"wrap-ansi/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
|
||||||
|
|
||||||
|
|
@ -1826,6 +1819,26 @@
|
||||||
|
|
||||||
"@prisma/config/c12/perfect-debounce": ["perfect-debounce@1.0.0", "", {}, "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA=="],
|
"@prisma/config/c12/perfect-debounce": ["perfect-debounce@1.0.0", "", {}, "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/env": ["@next/env@16.1.7", "", {}, "sha512-rJJbIdJB/RQr2F1nylZr/PJzamvNNhfr3brdKP6s/GW850jbtR70QlSfFselvIBbcPUOlQwBakexjFzqLzF6pg=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.1.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-b2wWIE8sABdyafc4IM8r5Y/dS6kD80JRtOGrUiKTsACFQfWWgUQ2NwoUX1yjFMXVsAwcQeNpnucF2ZrujsBBPg=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.1.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-zcnVaaZulS1WL0Ss38R5Q6D2gz7MtBu8GZLPfK+73D/hp4GFMrC2sudLky1QibfV7h6RJBJs/gOFvYP0X7UVlQ=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.1.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-2ant89Lux/Q3VyC8vNVg7uBaFVP9SwoK2jJOOR0L8TQnX8CAYnh4uctAScy2Hwj2dgjVHqHLORQZJ2wH6VxhSQ=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.1.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-uufcze7LYv0FQg9GnNeZ3/whYfo+1Q3HnQpm16o6Uyi0OVzLlk2ZWoY7j07KADZFY8qwDbsmFnMQP3p3+Ftprw=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.1.7", "", { "os": "linux", "cpu": "x64" }, "sha512-KWVf2gxYvHtvuT+c4MBOGxuse5TD7DsMFYSxVxRBnOzok/xryNeQSjXgxSv9QpIVlaGzEn/pIuI6Koosx8CGWA=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.1.7", "", { "os": "linux", "cpu": "x64" }, "sha512-HguhaGwsGr1YAGs68uRKc4aGWxLET+NevJskOcCAwXbwj0fYX0RgZW2gsOCzr9S11CSQPIkxmoSbuVaBp4Z3dA=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.1.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-S0n3KrDJokKTeFyM/vGGGR8+pCmXYrjNTk2ZozOL1C/JFdfUIL9O1ATaJOl5r2POe56iRChbsszrjMAdWSv7kQ=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.1.7", "", { "os": "win32", "cpu": "x64" }, "sha512-mwgtg8CNZGYm06LeEd+bNnOUfwOyNem/rOiP14Lsz+AnUY92Zq/LXwtebtUiaeVkhbroRCQ0c8GlR4UT1U+0yg=="],
|
||||||
|
|
||||||
|
"@react-email/preview-server/next/postcss": ["postcss@8.4.31", "", { "dependencies": { "nanoid": "^3.3.6", "picocolors": "^1.0.0", "source-map-js": "^1.0.2" } }, "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ=="],
|
||||||
|
|
||||||
"@types/cors/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
|
"@types/cors/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
|
||||||
|
|
||||||
"@types/nodemailer/@types/node/undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
|
"@types/nodemailer/@types/node/undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
|
||||||
|
|
@ -1840,6 +1853,60 @@
|
||||||
|
|
||||||
"cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
|
"cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.25.12", "", { "os": "android", "cpu": "arm64" }, "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.25.12", "", { "os": "android", "cpu": "x64" }, "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.25.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.25.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.25.12", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.25.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.25.12", "", { "os": "linux", "cpu": "arm" }, "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.25.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.25.12", "", { "os": "linux", "cpu": "ia32" }, "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.25.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.25.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.25.12", "", { "os": "linux", "cpu": "x64" }, "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.25.12", "", { "os": "none", "cpu": "x64" }, "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.25.12", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.25.12", "", { "os": "openbsd", "cpu": "x64" }, "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.25.12", "", { "os": "sunos", "cpu": "x64" }, "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.25.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.25.12", "", { "os": "win32", "cpu": "ia32" }, "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ=="],
|
||||||
|
|
||||||
|
"drizzle-kit/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.25.12", "", { "os": "win32", "cpu": "x64" }, "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA=="],
|
||||||
|
|
||||||
|
"drizzle-kit/tsx/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="],
|
||||||
|
|
||||||
"engine.io/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
|
"engine.io/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
|
||||||
|
|
||||||
"express/accepts/negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="],
|
"express/accepts/negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="],
|
||||||
|
|
@ -1850,111 +1917,59 @@
|
||||||
|
|
||||||
"ora/log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
|
"ora/log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.3", "", { "os": "aix", "cpu": "ppc64" }, "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.3", "", { "os": "android", "cpu": "arm" }, "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.3", "", { "os": "android", "cpu": "arm64" }, "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.3", "", { "os": "android", "cpu": "x64" }, "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.3", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.3", "", { "os": "linux", "cpu": "arm" }, "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.3", "", { "os": "linux", "cpu": "ia32" }, "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.3", "", { "os": "linux", "cpu": "x64" }, "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.3", "", { "os": "none", "cpu": "x64" }, "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.3", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.3", "", { "os": "openbsd", "cpu": "x64" }, "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.3", "", { "os": "sunos", "cpu": "x64" }, "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q=="],
|
|
||||||
|
|
||||||
"react-email/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="],
|
|
||||||
|
|
||||||
"shadcn/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
|
"shadcn/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.3", "", { "os": "aix", "cpu": "ppc64" }, "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg=="],
|
"tsx/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.3", "", { "os": "android", "cpu": "arm" }, "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA=="],
|
"tsx/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.3", "", { "os": "android", "cpu": "arm64" }, "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg=="],
|
"tsx/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.3", "", { "os": "android", "cpu": "x64" }, "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ=="],
|
"tsx/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg=="],
|
"tsx/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg=="],
|
"tsx/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.3", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w=="],
|
"tsx/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA=="],
|
"tsx/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.3", "", { "os": "linux", "cpu": "arm" }, "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw=="],
|
"tsx/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg=="],
|
"tsx/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.3", "", { "os": "linux", "cpu": "ia32" }, "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg=="],
|
"tsx/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA=="],
|
"tsx/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw=="],
|
"tsx/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA=="],
|
"tsx/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ=="],
|
"tsx/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw=="],
|
"tsx/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.3", "", { "os": "linux", "cpu": "x64" }, "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA=="],
|
"tsx/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA=="],
|
"tsx/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.3", "", { "os": "none", "cpu": "x64" }, "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA=="],
|
"tsx/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.3", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw=="],
|
"tsx/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.3", "", { "os": "openbsd", "cpu": "x64" }, "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ=="],
|
"tsx/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g=="],
|
"tsx/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.3", "", { "os": "sunos", "cpu": "x64" }, "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA=="],
|
"tsx/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA=="],
|
"tsx/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q=="],
|
"tsx/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
|
||||||
|
|
||||||
"tsx/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="],
|
"tsx/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
|
||||||
|
|
||||||
"wrap-ansi/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
|
"wrap-ansi/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
|
||||||
|
|
||||||
|
|
|
||||||
2763
package-lock.json
generated
2763
package-lock.json
generated
File diff suppressed because it is too large
Load diff
62
package.json
62
package.json
|
|
@ -10,18 +10,27 @@
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"license": "AGPL-3.0",
|
"license": "AGPL-3.0",
|
||||||
"version": "0.1.1",
|
"version": "0.2.0",
|
||||||
"private": true,
|
"private": true,
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"dev": "cross-env NODE_ENV=development FEDERATION_ALLOW_PRIVATE_URLS=true tsx src/server.ts",
|
"dev": "cross-env NODE_ENV=development FEDERATION_ALLOW_PRIVATE_URLS=true tsx src/server.ts",
|
||||||
"email:dev": "cross-env NODE_ENV=development email dev --dir src/lib/mail/templates --port 3001",
|
"email:dev": "cross-env NODE_ENV=development email dev --dir src/lib/mail/templates --port 3001",
|
||||||
"test": "cross-env NODE_ENV=test playwright test",
|
"test": "cross-env NODE_ENV=test playwright test",
|
||||||
"test:proxy:post": "cross-env NODE_ENV=test bun run tests/proxies/post.ts",
|
"test:integration:post": "cross-env NODE_ENV=test bun run tests/integration/federation-post-delivery.ts",
|
||||||
"test:proxy:follow": "cross-env NODE_ENV=test bun run tests/proxies/follow.ts",
|
"test:integration:proxy-chain": "cross-env NODE_ENV=test bun run tests/integration/proxy-chain.ts",
|
||||||
"keygen": "bun run src/lib/federation/keygen.ts",
|
"keygen": "bun run src/lib/federation/keygen.ts",
|
||||||
"test:key": "cross-env NODE_ENV=test playwright test tests/key.test.ts",
|
"docker:generate-keys": "bun run tests/docker/generate-keys.ts",
|
||||||
"test:discover": "cross-env NODE_ENV=test playwright test tests/discover.test.ts",
|
"docker:setup-discovery": "docker compose -f tests/docker-compose.yml run --rm setup-discovery",
|
||||||
"test:attacks": "cross-env NODE_ENV=test playwright test tests/attacks.test.ts",
|
"docker:build": "docker compose -f tests/docker-compose.yml --profile init --profile setup --profile test build",
|
||||||
|
"docker:up": "docker compose -f tests/docker-compose.yml up -d",
|
||||||
|
"docker:down": "docker compose -f tests/docker-compose.yml down",
|
||||||
|
"docker:init": "docker compose -f tests/docker-compose.yml --profile init up",
|
||||||
|
"docker:test:proxy-chain": "docker compose -f tests/docker-compose.yml run --rm test-runner tests/integration/proxy-chain.ts --proxy http://sipher-b:3001 --target http://sipher-c:3002",
|
||||||
|
"docker:test:post-delivery": "docker compose -f tests/docker-compose.yml run --rm test-runner tests/integration/federation-post-delivery.ts --proxy http://sipher-b:3001 --target http://sipher-c:3002",
|
||||||
|
"docker:test:discover": "docker compose -f tests/docker-compose.yml run --rm test-runner tests/integration/discover.ts --peer http://sipher-c:3002",
|
||||||
|
"test:key": "cross-env NODE_ENV=test playwright test tests/federation/key-rotation.e2e.ts",
|
||||||
|
"test:federation": "cross-env NODE_ENV=test playwright test tests/federation",
|
||||||
|
"test:proxy": "cross-env NODE_ENV=test playwright test tests/proxy",
|
||||||
"build": "next build",
|
"build": "next build",
|
||||||
"build:matrix": "cd node_modules/@matrix-org/matrix-sdk-crypto-nodejs && node download-lib.js",
|
"build:matrix": "cd node_modules/@matrix-org/matrix-sdk-crypto-nodejs && node download-lib.js",
|
||||||
"start": "cross-env NODE_ENV=production node src/server.ts",
|
"start": "cross-env NODE_ENV=production node src/server.ts",
|
||||||
|
|
@ -31,62 +40,61 @@
|
||||||
"db:update": "bun run db:generate && bun run db:push"
|
"db:update": "bun run db:generate && bun run db:push"
|
||||||
},
|
},
|
||||||
"dependencies": {
|
"dependencies": {
|
||||||
"@better-auth/drizzle-adapter": "^1.6.9",
|
"@better-auth/drizzle-adapter": "^1.6.11",
|
||||||
"@hookform/resolvers": "^5.2.2",
|
"@hookform/resolvers": "^5.2.2",
|
||||||
"@matrix-org/matrix-sdk-crypto-wasm": "^18.2.0",
|
"@matrix-org/matrix-sdk-crypto-wasm": "^18.3.0",
|
||||||
"@nanostores/react": "^1.1.0",
|
"@noble/ciphers": "^2.2.0",
|
||||||
|
"@noble/hashes": "^2.2.0",
|
||||||
"@react-email/components": "1.0.12",
|
"@react-email/components": "1.0.12",
|
||||||
|
"@react-email/render": "^2.0.8",
|
||||||
|
"@react-email/tailwind": "^2.0.7",
|
||||||
"@scure/bip39": "^2.2.0",
|
"@scure/bip39": "^2.2.0",
|
||||||
"@signalapp/libsignal-client": "^0.92.2",
|
"better-auth": "^1.6.11",
|
||||||
"base58-js": "^3.0.3",
|
"bullmq": "^5.76.10",
|
||||||
"better-auth": "^1.6.9",
|
|
||||||
"bullmq": "^5.76.5",
|
|
||||||
"class-variance-authority": "^0.7.1",
|
"class-variance-authority": "^0.7.1",
|
||||||
"clsx": "^2.1.1",
|
"clsx": "^2.1.1",
|
||||||
"debug": "^4.4.3",
|
"debug": "^4.4.3",
|
||||||
"dexie": "^4.4.2",
|
"dexie": "^4.4.2",
|
||||||
"dexie-react-hooks": "^4.4.0",
|
|
||||||
"dotenv": "^17.4.2",
|
"dotenv": "^17.4.2",
|
||||||
"drizzle-orm": "^0.45.2",
|
"drizzle-orm": "^0.45.2",
|
||||||
"framer-motion": "^12.38.0",
|
"framer-motion": "^12.38.0",
|
||||||
"ioredis": "^5.10.1",
|
"ioredis": "^5.10.1",
|
||||||
"lucide-react": "^1.14.0",
|
"lucide-react": "^1.16.0",
|
||||||
"minio": "^8.0.7",
|
"minio": "^8.0.7",
|
||||||
"nanostores": "^1.3.0",
|
|
||||||
"next": "16.2.3",
|
"next": "16.2.3",
|
||||||
"next-themes": "^0.4.6",
|
"next-themes": "^0.4.6",
|
||||||
"nodemailer": "^8.0.7",
|
"nodemailer": "^8.0.7",
|
||||||
"pg": "^8.20.0",
|
"pg": "^8.21.0",
|
||||||
"radix-ui": "^1.4.3",
|
"radix-ui": "^1.4.3",
|
||||||
"react": "19.2.5",
|
"react": "19.2.5",
|
||||||
"react-dom": "19.2.5",
|
"react-dom": "19.2.5",
|
||||||
"react-hook-form": "^7.75.0",
|
"react-hook-form": "^7.76.0",
|
||||||
"socket.io": "^4.8.3",
|
"socket.io": "^4.8.3",
|
||||||
"socket.io-client": "^4.8.3",
|
|
||||||
"sonner": "^2.0.7",
|
"sonner": "^2.0.7",
|
||||||
"tailwind-merge": "^3.5.0",
|
"tailwind-merge": "^3.6.0",
|
||||||
"tweetnacl": "^1.0.3",
|
"tweetnacl": "^1.0.3",
|
||||||
"tweetnacl-util": "^0.15.1",
|
|
||||||
"uuid": "^14.0.0",
|
"uuid": "^14.0.0",
|
||||||
"zod": "^4.4.3"
|
"zod": "^4.4.3"
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@tailwindcss/postcss": "^4.2.4",
|
"@playwright/test": "^1.60.0",
|
||||||
"@types/bun": "^1.3.13",
|
"@react-email/preview-server": "^5.2.10",
|
||||||
|
"@tailwindcss/postcss": "^4.3.0",
|
||||||
|
"@types/bun": "^1.3.14",
|
||||||
"@types/debug": "^4.1.13",
|
"@types/debug": "^4.1.13",
|
||||||
"@types/node": "^25.6.0",
|
"@types/node": "^25.8.0",
|
||||||
"@types/nodemailer": "^8.0.0",
|
"@types/nodemailer": "^8.0.0",
|
||||||
"@types/pg": "^8.20.0",
|
"@types/pg": "^8.20.0",
|
||||||
"@types/react": "^19.2.14",
|
"@types/react": "^19.2.14",
|
||||||
"@types/react-dom": "^19.2.3",
|
"@types/react-dom": "^19.2.3",
|
||||||
"auth": "^1.6.9",
|
"auth": "^1.6.11",
|
||||||
"babel-plugin-react-compiler": "1.0.0",
|
"babel-plugin-react-compiler": "1.0.0",
|
||||||
"cross-env": "^10.1.0",
|
"cross-env": "^10.1.0",
|
||||||
"drizzle-kit": "^0.31.10",
|
"drizzle-kit": "^0.31.10",
|
||||||
"react-email": "5.2.10",
|
"react-email": "5.2.10",
|
||||||
"shadcn": "^4.7.0",
|
"shadcn": "^4.7.0",
|
||||||
"tailwindcss": "^4.2.4",
|
"tailwindcss": "^4.3.0",
|
||||||
"tsx": "^4.21.0",
|
"tsx": "^4.22.1",
|
||||||
"tw-animate-css": "^1.4.0",
|
"tw-animate-css": "^1.4.0",
|
||||||
"typescript": "^6.0.3"
|
"typescript": "^6.0.3"
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -6,6 +6,8 @@ dotenv.config({ path: path.resolve(__dirname, '.env.local') });
|
||||||
|
|
||||||
export default defineConfig({
|
export default defineConfig({
|
||||||
testDir: './tests',
|
testDir: './tests',
|
||||||
|
/** Bun discovers `*.test.ts` / `*.spec.ts` as Bun tests; keep HTTP suites under `*.e2e.ts`. */
|
||||||
|
testMatch: '**/*.e2e.ts',
|
||||||
fullyParallel: true,
|
fullyParallel: true,
|
||||||
forbidOnly: !!process.env.CI,
|
forbidOnly: !!process.env.CI,
|
||||||
retries: process.env.CI ? 2 : 0,
|
retries: process.env.CI ? 2 : 0,
|
||||||
|
|
@ -19,6 +21,7 @@ export default defineConfig({
|
||||||
command: 'cross-env NODE_ENV=test tsx src/server.ts',
|
command: 'cross-env NODE_ENV=test tsx src/server.ts',
|
||||||
url: process.env.BETTER_AUTH_URL,
|
url: process.env.BETTER_AUTH_URL,
|
||||||
reuseExistingServer: !process.env.CI,
|
reuseExistingServer: !process.env.CI,
|
||||||
|
timeout: 120_000,
|
||||||
},
|
},
|
||||||
projects: [
|
projects: [
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -8,7 +8,6 @@ export function PostTestForm() {
|
||||||
const { data: session } = authClient.useSession();
|
const { data: session } = authClient.useSession();
|
||||||
const [text, setText] = useState("");
|
const [text, setText] = useState("");
|
||||||
const [files, setFiles] = useState<File[]>([]);
|
const [files, setFiles] = useState<File[]>([]);
|
||||||
const [password, setPassword] = useState("");
|
|
||||||
const [status, setStatus] = useState<string | null>(null);
|
const [status, setStatus] = useState<string | null>(null);
|
||||||
|
|
||||||
const handleSubmit = async () => {
|
const handleSubmit = async () => {
|
||||||
|
|
@ -16,10 +15,6 @@ export function PostTestForm() {
|
||||||
setStatus("Not signed in.");
|
setStatus("Not signed in.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
if (!password) {
|
|
||||||
setStatus("Enter your master password to unlock the signing key.");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
setStatus("Signing & submitting...");
|
setStatus("Signing & submitting...");
|
||||||
try {
|
try {
|
||||||
|
|
@ -38,7 +33,7 @@ export function PostTestForm() {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
const result = await authClient.createPost(content, session.user.id, password);
|
const result = await authClient.createPost(content, session.user.id);
|
||||||
setStatus(`Done: ${JSON.stringify(result)}`);
|
setStatus(`Done: ${JSON.stringify(result)}`);
|
||||||
} catch (err) {
|
} catch (err) {
|
||||||
setStatus(`Error: ${err instanceof Error ? err.message : String(err)}`);
|
setStatus(`Error: ${err instanceof Error ? err.message : String(err)}`);
|
||||||
|
|
@ -101,19 +96,6 @@ export function PostTestForm() {
|
||||||
)}
|
)}
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div style={{ marginBottom: 12 }}>
|
|
||||||
<label style={{ display: "block", marginBottom: 4, fontWeight: 600 }}>
|
|
||||||
Master password (unlocks signing key)
|
|
||||||
</label>
|
|
||||||
<input
|
|
||||||
type="password"
|
|
||||||
value={password}
|
|
||||||
onChange={(e) => setPassword(e.target.value)}
|
|
||||||
placeholder="••••••••••••"
|
|
||||||
style={{ width: "100%", padding: 8, fontSize: 14 }}
|
|
||||||
/>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<button
|
<button
|
||||||
onClick={handleSubmit}
|
onClick={handleSubmit}
|
||||||
style={{
|
style={{
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,7 @@
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
||||||
import { decryptPayload, verifySignature } from "@/lib/federation/keytools";
|
import { decryptPayload, verifySignature } from "@/lib/federation/keytools";
|
||||||
|
import { isJsonObjectBody } from "@/lib/http/json-object-body";
|
||||||
import createDebug from "debug";
|
import createDebug from "debug";
|
||||||
import { eq, sql } from "drizzle-orm";
|
import { eq, sql } from "drizzle-orm";
|
||||||
import { NextRequest, NextResponse } from "next/server";
|
import { NextRequest, NextResponse } from "next/server";
|
||||||
|
|
@ -34,11 +35,18 @@ const debug = createDebug("app:discover:rotate:confirm");
|
||||||
* - encryptionOldPlaintext: SB holds the old X25519 private key (encryption identity proof)
|
* - encryptionOldPlaintext: SB holds the old X25519 private key (encryption identity proof)
|
||||||
* - encryptionNewPlaintext: SB holds the new X25519 private key (encryption ownership proof)
|
* - encryptionNewPlaintext: SB holds the new X25519 private key (encryption ownership proof)
|
||||||
* - Envelope encrypted with SA's X25519 key: SB fetched SA's /discover (identity binding)
|
* - Envelope encrypted with SA's X25519 key: SB fetched SA's /discover (identity binding)
|
||||||
* - Discover being fetched: SB fetched SA's /discover endpoint (liveliness proof) <- Not accounted for but it is a proof that the other federation is alive and responsive.
|
|
||||||
*/
|
*/
|
||||||
export async function POST(request: NextRequest) {
|
export async function POST(request: NextRequest) {
|
||||||
const body = await request.json();
|
let body: unknown;
|
||||||
debug("POST /discover/rotate/confirm – confirmation request for %s", body?.serverUrl);
|
try {
|
||||||
|
body = await request.json();
|
||||||
|
} catch {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_JSON" }, { status: 400 });
|
||||||
|
}
|
||||||
|
if (!isJsonObjectBody(body)) {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_JSON" }, { status: 400 });
|
||||||
|
}
|
||||||
|
debug("POST /discover/rotate/confirm – confirmation request for %s", (body as { serverUrl?: string }).serverUrl);
|
||||||
|
|
||||||
const validated = z.object({
|
const validated = z.object({
|
||||||
serverUrl: z.url(),
|
serverUrl: z.url(),
|
||||||
|
|
@ -81,15 +89,15 @@ export async function POST(request: NextRequest) {
|
||||||
}
|
}
|
||||||
|
|
||||||
if (challenge.attemptsLeft <= 0) {
|
if (challenge.attemptsLeft <= 0) {
|
||||||
debug("POST /discover/rotate/confirm – no attempts left, blacklisting %s", challenge.serverUrl);
|
// Cancel the challenge without blacklisting the server. Blacklisting
|
||||||
await tx.insert(blacklistedServers).values({
|
// here would be unsafe because anyone can open an init challenge for
|
||||||
id: crypto.randomUUID(),
|
// an arbitrary server URL — auto-blacklisting on failed confirms
|
||||||
serverUrl: challenge.serverUrl,
|
// lets an attacker permanently ban a legitimate peer with no effort.
|
||||||
reason: "Too many failed attempts to confirm key rotation challenge",
|
debug("POST /discover/rotate/confirm – no attempts left, cancelling challenge for %s", challenge.serverUrl);
|
||||||
createdAt: new Date(),
|
|
||||||
});
|
|
||||||
await tx.delete(rotateChallengeTokens).where(eq(rotateChallengeTokens.id, challenge.id));
|
await tx.delete(rotateChallengeTokens).where(eq(rotateChallengeTokens.id, challenge.id));
|
||||||
return NextResponse.json({ error: "Your server has been blacklisted. Please contact support to unblacklist your server." }, { status: 403 });
|
return NextResponse.json({
|
||||||
|
error: "Too many failed attempts. The rotation challenge has been cancelled. Please initiate a new rotation.",
|
||||||
|
}, { status: 403 });
|
||||||
}
|
}
|
||||||
|
|
||||||
debug("POST /discover/rotate/confirm – %d attempt(s) left, decrypting envelope", challenge.attemptsLeft);
|
debug("POST /discover/rotate/confirm – %d attempt(s) left, decrypting envelope", challenge.attemptsLeft);
|
||||||
|
|
@ -113,7 +121,7 @@ export async function POST(request: NextRequest) {
|
||||||
attemptsLeft: sql`${rotateChallengeTokens.attemptsLeft} - 1`,
|
attemptsLeft: sql`${rotateChallengeTokens.attemptsLeft} - 1`,
|
||||||
}).where(eq(rotateChallengeTokens.id, challenge.id));
|
}).where(eq(rotateChallengeTokens.id, challenge.id));
|
||||||
return NextResponse.json({
|
return NextResponse.json({
|
||||||
error: `Failed to decrypt envelope. You have ${challenge.attemptsLeft - 1} attempts left before your server is blacklisted.`,
|
error: `Failed to decrypt envelope. You have ${challenge.attemptsLeft - 1} attempt(s) left.`,
|
||||||
}, { status: 400 });
|
}, { status: 400 });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -153,7 +161,7 @@ export async function POST(request: NextRequest) {
|
||||||
attemptsLeft: sql`${rotateChallengeTokens.attemptsLeft} - 1`,
|
attemptsLeft: sql`${rotateChallengeTokens.attemptsLeft} - 1`,
|
||||||
}).where(eq(rotateChallengeTokens.id, challenge.id));
|
}).where(eq(rotateChallengeTokens.id, challenge.id));
|
||||||
return NextResponse.json({
|
return NextResponse.json({
|
||||||
error: `Challenge verification failed. You have ${challenge.attemptsLeft - 1} attempts left before your server is blacklisted.`,
|
error: `Challenge verification failed. You have ${challenge.attemptsLeft - 1} attempt(s) left.`,
|
||||||
}, { status: 400 });
|
}, { status: 400 });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,8 @@
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
||||||
import { encryptPayload } from "@/lib/federation/keytools";
|
import { encryptPayload } from "@/lib/federation/keytools";
|
||||||
|
import { isJsonObjectBody } from "@/lib/http/json-object-body";
|
||||||
|
import { checkRateLimit } from "@/lib/rate-limit/rate-limit";
|
||||||
import createDebug from "debug";
|
import createDebug from "debug";
|
||||||
import { eq } from "drizzle-orm";
|
import { eq } from "drizzle-orm";
|
||||||
import { NextRequest, NextResponse } from "next/server";
|
import { NextRequest, NextResponse } from "next/server";
|
||||||
|
|
@ -44,8 +46,16 @@ const schema = z.object({
|
||||||
* Challenges expire in 5 minutes. SB confirms via /discover/rotate/confirm.
|
* Challenges expire in 5 minutes. SB confirms via /discover/rotate/confirm.
|
||||||
*/
|
*/
|
||||||
export async function POST(request: NextRequest) {
|
export async function POST(request: NextRequest) {
|
||||||
const body = await request.json();
|
let body: unknown;
|
||||||
debug("POST /discover/rotate/init – rotation request for %s", body?.url);
|
try {
|
||||||
|
body = await request.json();
|
||||||
|
} catch {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_JSON" }, { status: 400 });
|
||||||
|
}
|
||||||
|
if (!isJsonObjectBody(body)) {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_JSON" }, { status: 400 });
|
||||||
|
}
|
||||||
|
debug("POST /discover/rotate/init – rotation request for %s", (body as { url?: string }).url);
|
||||||
|
|
||||||
const validated = schema.safeParse(body);
|
const validated = schema.safeParse(body);
|
||||||
if (!validated.success) {
|
if (!validated.success) {
|
||||||
|
|
@ -53,6 +63,18 @@ export async function POST(request: NextRequest) {
|
||||||
return NextResponse.json({ error: validated.error.message }, { status: 400 });
|
return NextResponse.json({ error: validated.error.message }, { status: 400 });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Per-serverUrl rate limit to prevent bulk rotation init attempts
|
||||||
|
const rlResult = await checkRateLimit(`rotate-init:${validated.data.url.toString()}`, {
|
||||||
|
limit: 2,
|
||||||
|
windowSeconds: 60,
|
||||||
|
});
|
||||||
|
if (!rlResult.allowed) {
|
||||||
|
debug("POST /discover/rotate/init – rate limited for %s", validated.data.url);
|
||||||
|
return NextResponse.json({
|
||||||
|
error: "Too many rotation init attempts for this server. Please try again later.",
|
||||||
|
}, { status: 429 });
|
||||||
|
}
|
||||||
|
|
||||||
const [blacklisted] = await db.select().from(blacklistedServers)
|
const [blacklisted] = await db.select().from(blacklistedServers)
|
||||||
.where(eq(blacklistedServers.serverUrl, validated.data.url.toString()));
|
.where(eq(blacklistedServers.serverUrl, validated.data.url.toString()));
|
||||||
if (blacklisted) {
|
if (blacklisted) {
|
||||||
|
|
|
||||||
|
|
@ -186,10 +186,15 @@ async function registerServer(validated: z.infer<typeof registerSchema>) {
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function POST(request: NextRequest) {
|
export async function POST(request: NextRequest) {
|
||||||
const body = await request.json();
|
let body: unknown;
|
||||||
debug("POST /discover – method: %s", body?.method);
|
try {
|
||||||
|
body = await request.json();
|
||||||
|
} catch {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_JSON" }, { status: 400 });
|
||||||
|
}
|
||||||
|
debug("POST /discover – method: %s", (body as { method?: string })?.method);
|
||||||
|
|
||||||
if (body?.method === "DISCOVER") {
|
if (typeof body === "object" && body !== null && (body as { method?: string }).method === "DISCOVER") {
|
||||||
const validated = discoverSchema.safeParse(body);
|
const validated = discoverSchema.safeParse(body);
|
||||||
if (!validated.success) {
|
if (!validated.success) {
|
||||||
debug("POST /discover – DISCOVER validation failed: %o", validated.error.message);
|
debug("POST /discover – DISCOVER validation failed: %o", validated.error.message);
|
||||||
|
|
@ -198,7 +203,7 @@ export async function POST(request: NextRequest) {
|
||||||
return await discoverServer(validated.data);
|
return await discoverServer(validated.data);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (body?.method === "REGISTER") {
|
if (typeof body === "object" && body !== null && (body as { method?: string }).method === "REGISTER") {
|
||||||
const validated = registerSchema.safeParse(body);
|
const validated = registerSchema.safeParse(body);
|
||||||
if (!validated.success) {
|
if (!validated.success) {
|
||||||
debug("POST /discover – REGISTER validation failed: %o", validated.error.message);
|
debug("POST /discover – REGISTER validation failed: %o", validated.error.message);
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,4 @@
|
||||||
|
import UnlockIdentityModal from "@/components/main/UnlockIdentityModal";
|
||||||
import { TooltipProvider } from "@/components/ui/tooltip";
|
import { TooltipProvider } from "@/components/ui/tooltip";
|
||||||
import type { Metadata } from "next";
|
import type { Metadata } from "next";
|
||||||
import { ThemeProvider } from "next-themes";
|
import { ThemeProvider } from "next-themes";
|
||||||
|
|
@ -49,6 +50,7 @@ export default function RootLayout({
|
||||||
>
|
>
|
||||||
<TooltipProvider>
|
<TooltipProvider>
|
||||||
<Toaster />
|
<Toaster />
|
||||||
|
<UnlockIdentityModal />
|
||||||
{children}
|
{children}
|
||||||
</TooltipProvider>
|
</TooltipProvider>
|
||||||
</ThemeProvider>
|
</ThemeProvider>
|
||||||
|
|
|
||||||
|
|
@ -1,10 +1,11 @@
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { blacklistedServers, follows, serverRegistry, user } from "@/lib/db/schema";
|
import { blacklistedServers, blocks, follows, serverRegistry, user } from "@/lib/db/schema";
|
||||||
import { FederationError, federationFetch } from "@/lib/federation/fetch";
|
import { FederationError, federationFetch } from "@/lib/federation/fetch";
|
||||||
import { decryptPayload, encryptPayload, getOwnEncryptionSecretKey, getOwnSigningSecretKey, signMessage, verifySignature } from "@/lib/federation/keytools";
|
import { decryptPayload, encryptPayload, getOwnEncryptionSecretKey, getOwnSigningSecretKey, signMessage, verifySignature } from "@/lib/federation/keytools";
|
||||||
import { peerRegistryUrlOrNull } from "@/lib/federation/peer-registry-url";
|
import { peerRegistryUrlOrNull } from "@/lib/federation/peer-registry-url";
|
||||||
import { applyFederatedPostInTransaction } from "@/lib/federation/proxy-helpers/federated-post";
|
import { applyFederatedPostInTransaction } from "@/lib/federation/proxy-helpers/federated-post";
|
||||||
import { discoverAndRegister } from "@/lib/federation/registry";
|
import { discoverAndRegister } from "@/lib/federation/registry";
|
||||||
|
import { checkRateLimit } from "@/lib/rate-limit/rate-limit";
|
||||||
import { EncryptedEnvelopeBaseSchema } from "@/lib/zod/EncryptedEnvelope";
|
import { EncryptedEnvelopeBaseSchema } from "@/lib/zod/EncryptedEnvelope";
|
||||||
import { FollowEnvelopeSchema } from "@/lib/zod/methods/FollowSchema";
|
import { FollowEnvelopeSchema } from "@/lib/zod/methods/FollowSchema";
|
||||||
import { PostEnvelopeSchema } from "@/lib/zod/methods/PostFederationSchema";
|
import { PostEnvelopeSchema } from "@/lib/zod/methods/PostFederationSchema";
|
||||||
|
|
@ -71,14 +72,42 @@ type UserActions = "FEDERATE_FOLLOW" | "FEDERATE_UNFOLLOW" | "GET_USER_PROFILE"
|
||||||
|
|
||||||
type Actions = PostsActions | UserActions;
|
type Actions = PostsActions | UserActions;
|
||||||
|
|
||||||
|
const PROXY_MAX_BODY_BYTES = 256 * 1024; // 256 KB
|
||||||
|
|
||||||
export async function POST(request: NextRequest) {
|
export async function POST(request: NextRequest) {
|
||||||
|
const contentLength = request.headers.get("content-length");
|
||||||
|
if (contentLength && parseInt(contentLength, 10) > PROXY_MAX_BODY_BYTES) {
|
||||||
|
debug("POST /proxy – request body too large (%s bytes)", contentLength);
|
||||||
|
return NextResponse.json({ error: "Request body too large", code: "PAYLOAD_TOO_LARGE" }, { status: 413 });
|
||||||
|
}
|
||||||
|
|
||||||
const getFedUrl = request.headers.get("x-federation-origin");
|
const getFedUrl = request.headers.get("x-federation-origin");
|
||||||
if (!getFedUrl) {
|
if (!getFedUrl) {
|
||||||
debug("Missing x-federation-origin header from %s", request.url);
|
debug("Missing x-federation-origin header from %s", request.url);
|
||||||
return NextResponse.json({ error: "Missing x-federation-origin header", code: "MISSING_FED_ORIGIN_HEADER" }, { status: 400 });
|
return NextResponse.json({ error: "Missing x-federation-origin header", code: "MISSING_FED_ORIGIN_HEADER" }, { status: 400 });
|
||||||
}
|
}
|
||||||
|
|
||||||
const data = await request.clone().json();
|
const proxyRateLimit = await checkRateLimit(`proxy:${getFedUrl}`, { limit: 100, windowSeconds: 60 });
|
||||||
|
if (!proxyRateLimit.allowed) {
|
||||||
|
debug("POST /proxy – rate limited origin %s", getFedUrl);
|
||||||
|
return NextResponse.json(
|
||||||
|
{ error: "Too many proxy requests. Please try again later.", code: "RATE_LIMITED" },
|
||||||
|
{ status: 429, headers: { "Retry-After": String(proxyRateLimit.retryAfter) } },
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
const rawBody = await request.text();
|
||||||
|
if (rawBody.length > PROXY_MAX_BODY_BYTES) {
|
||||||
|
debug("POST /proxy – request body too large (%d bytes)", rawBody.length);
|
||||||
|
return NextResponse.json({ error: "Request body too large", code: "PAYLOAD_TOO_LARGE" }, { status: 413 });
|
||||||
|
}
|
||||||
|
|
||||||
|
let data: unknown;
|
||||||
|
try {
|
||||||
|
data = JSON.parse(rawBody);
|
||||||
|
} catch {
|
||||||
|
return NextResponse.json({ error: "Invalid JSON", code: "INVALID_PROXY_DATA" }, { status: 400 });
|
||||||
|
}
|
||||||
const parsed = ProxiedDataSchema.safeParse(data);
|
const parsed = ProxiedDataSchema.safeParse(data);
|
||||||
if (!parsed.success) {
|
if (!parsed.success) {
|
||||||
debug("POST /proxy – error parsing proxied data from %s: %s", request.url, parsed.error.message);
|
debug("POST /proxy – error parsing proxied data from %s: %s", request.url, parsed.error.message);
|
||||||
|
|
@ -87,334 +116,380 @@ export async function POST(request: NextRequest) {
|
||||||
|
|
||||||
switch (parsed.data.method) {
|
switch (parsed.data.method) {
|
||||||
case "PROXY": {
|
case "PROXY": {
|
||||||
|
|
||||||
|
if (!parsed.data.publicSigningKey || !parsed.data.publicEncryptionKey) {
|
||||||
|
debug("POST /proxy – error parsing proxied data from %s: %s", request.url, "Missing public signing or encryption key");
|
||||||
|
return NextResponse.json({ error: "Invalid proxied data", code: "INVALID_PROXY_DATA" }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const proxiedData = parsed.data;
|
||||||
|
|
||||||
|
// Verify Federation A (sender) is known and keys match
|
||||||
|
const [sender] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, getFedUrl));
|
||||||
|
|
||||||
|
if (!sender) {
|
||||||
|
debug("POST /proxy – sender not found in registry: %s", getFedUrl);
|
||||||
|
return NextResponse.json({
|
||||||
|
error: "Unknown federation server. Please redo the discovery process and try again.",
|
||||||
|
code: "UNKNOWN_FEDERATION_SERVER_INTERACTION",
|
||||||
|
}, { status: 403 });
|
||||||
|
} else if (sender.publicKey !== proxiedData.publicSigningKey) {
|
||||||
|
debug("POST /proxy – sender signing key mismatch: %s", getFedUrl);
|
||||||
|
return NextResponse.json({
|
||||||
|
error: "The provided keys are a mismatch. If you rotated your keys, we are not aware of it.",
|
||||||
|
code: "INCORRECT_KEYS",
|
||||||
|
}, { status: 403 });
|
||||||
|
} else if (sender.encryptionPublicKey !== proxiedData.publicEncryptionKey) {
|
||||||
|
debug("POST /proxy – sender encryption key mismatch: %s", getFedUrl);
|
||||||
|
return NextResponse.json({
|
||||||
|
error: "The provided keys are a mismatch. If you rotated your keys, we are not aware of it.",
|
||||||
|
code: "INCORRECT_KEYS",
|
||||||
|
}, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
// Verify Federation B (target) is known to us (prevents open-relay abuse)
|
||||||
|
const targetBaseUrl = new URL(proxiedData.targetUrl.toString()).origin;
|
||||||
|
const [target] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, targetBaseUrl));
|
||||||
|
|
||||||
|
if (!target) {
|
||||||
|
debug("POST /proxy – target not found in registry: %s", targetBaseUrl);
|
||||||
|
debug("POST /proxy - Starting discovery process")
|
||||||
|
await discoverAndRegister(targetBaseUrl);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Proxy the request to Federation B as a TARGETED request (no proxy fallback — we ARE the proxy)
|
||||||
|
let forwardResponse: Response;
|
||||||
try {
|
try {
|
||||||
|
const result = await federationFetch(proxiedData.targetUrl.toString(), {
|
||||||
if (!parsed.data.publicSigningKey || !parsed.data.publicEncryptionKey) {
|
method: "POST",
|
||||||
debug("POST /proxy – error parsing proxied data from %s: %s", request.url, "Missing public signing or encryption key");
|
body: JSON.stringify({
|
||||||
return NextResponse.json({ error: "Invalid proxied data", code: "INVALID_PROXY_DATA" }, { status: 400 });
|
method: "TARGETED" as PROXY_METHOD,
|
||||||
|
payload: proxiedData.payload,
|
||||||
|
}),
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": process.env.BETTER_AUTH_URL!,
|
||||||
|
"Origin": process.env.BETTER_AUTH_URL!,
|
||||||
|
"X-Federation-Sender": getFedUrl,
|
||||||
|
},
|
||||||
|
serverUrl: targetBaseUrl,
|
||||||
|
proxyFallback: false,
|
||||||
|
skipHealthUpdate: true,
|
||||||
|
});
|
||||||
|
forwardResponse = result.response;
|
||||||
|
} catch (err) {
|
||||||
|
if (err instanceof FederationError) {
|
||||||
|
debug("POST /proxy – federation error proxying to %s: %s", proxiedData.targetUrl.toString(), err.code);
|
||||||
|
return NextResponse.json({ error: "Failed to proxy request", code: "FAILED_TO_PROXY_REQUEST", federationError: err.code, method: "PROXY_RESPONSE" as PROXY_METHOD }, { status: 502 });
|
||||||
}
|
}
|
||||||
|
throw err;
|
||||||
|
}
|
||||||
|
|
||||||
const proxiedData = parsed.data;
|
if (!forwardResponse.ok) {
|
||||||
|
debug("POST /proxy – error proxying request to %s: %s", proxiedData.targetUrl.toString(), forwardResponse.statusText);
|
||||||
|
let details: unknown;
|
||||||
|
try {
|
||||||
|
details = await forwardResponse.json();
|
||||||
|
} catch {
|
||||||
|
try {
|
||||||
|
details = await forwardResponse.text();
|
||||||
|
} catch {
|
||||||
|
details = undefined;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return NextResponse.json({ error: "Failed to proxy request", code: "FAILED_TO_PROXY_REQUEST", details, method: "PROXY_RESPONSE" as PROXY_METHOD }, { status: 502 });
|
||||||
|
}
|
||||||
|
|
||||||
// Verify Federation A (sender) is known and keys match
|
let responseBody: unknown;
|
||||||
const [sender] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, getFedUrl));
|
try {
|
||||||
|
responseBody = await forwardResponse.json();
|
||||||
|
} catch (err) {
|
||||||
|
debug("POST /proxy – invalid JSON from target %s: %o", proxiedData.targetUrl.toString(), err);
|
||||||
|
return NextResponse.json({ error: "Failed to proxy request", code: "FAILED_TO_PROXY_REQUEST", details: "Target returned non-JSON body", method: "PROXY_RESPONSE" as PROXY_METHOD }, { status: 502 });
|
||||||
|
}
|
||||||
|
|
||||||
if (!sender) {
|
// Return the response from Federation B as a PROXY_RESPONSE
|
||||||
debug("POST /proxy – sender not found in registry: %s", getFedUrl);
|
return NextResponse.json({
|
||||||
|
method: "PROXY_RESPONSE" as PROXY_METHOD,
|
||||||
|
payload: responseBody,
|
||||||
|
});
|
||||||
|
|
||||||
|
}
|
||||||
|
case "TARGETED": {
|
||||||
|
|
||||||
|
if (!parsed.data.payload) {
|
||||||
|
debug("POST /proxy – error parsing targeted data from %s: %s", request.url, "Missing payload");
|
||||||
|
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_TARGETED_DATA" }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
let decryptedPayload: string;
|
||||||
|
try {
|
||||||
|
decryptedPayload = decryptPayload(parsed.data.payload, getOwnEncryptionSecretKey());
|
||||||
|
} catch (decryptErr) {
|
||||||
|
debug("POST /proxy – targeted envelope decrypt failed from %s: %o", request.url, decryptErr);
|
||||||
|
return NextResponse.json({
|
||||||
|
error: "Cannot decrypt targeted payload for this server.",
|
||||||
|
code: "DECRYPT_FAILED",
|
||||||
|
}, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
let parsedPayload: unknown;
|
||||||
|
try {
|
||||||
|
parsedPayload = JSON.parse(decryptedPayload);
|
||||||
|
} catch {
|
||||||
|
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_TARGETED_DATA" }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
debug("POST /proxy – parsed targeted data from %s: %o", request.url, parsedPayload);
|
||||||
|
|
||||||
|
// PING: lightweight connectivity / crypto-routing check.
|
||||||
|
// Still enforces the sender trust model — the sender must be registered.
|
||||||
|
if (
|
||||||
|
typeof parsedPayload === "object" &&
|
||||||
|
parsedPayload !== null &&
|
||||||
|
(parsedPayload as { method?: string }).method === "PING"
|
||||||
|
) {
|
||||||
|
const [pingSender] = await db.select({ url: serverRegistry.url })
|
||||||
|
.from(serverRegistry)
|
||||||
|
.where(eq(serverRegistry.url, getFedUrl))
|
||||||
|
.limit(1);
|
||||||
|
if (!pingSender) {
|
||||||
|
debug("POST /proxy – PING from unregistered sender: %s", getFedUrl);
|
||||||
return NextResponse.json({
|
return NextResponse.json({
|
||||||
error: "Unknown federation server. Please redo the discovery process and try again.",
|
error: "Unknown federation server. Please redo the discovery process and try again.",
|
||||||
code: "UNKNOWN_FEDERATION_SERVER_INTERACTION",
|
code: "UNKNOWN_FEDERATION_SERVER_INTERACTION",
|
||||||
}, { status: 403 });
|
}, { status: 403 });
|
||||||
} else if (sender.publicKey !== proxiedData.publicSigningKey) {
|
|
||||||
debug("POST /proxy – sender signing key mismatch: %s", getFedUrl);
|
|
||||||
return NextResponse.json({
|
|
||||||
error: "The provided keys are a mismatch. If you rotated your keys, we are not aware of it.",
|
|
||||||
code: "INCORRECT_KEYS",
|
|
||||||
}, { status: 403 });
|
|
||||||
} else if (sender.encryptionPublicKey !== proxiedData.publicEncryptionKey) {
|
|
||||||
debug("POST /proxy – sender encryption key mismatch: %s", getFedUrl);
|
|
||||||
return NextResponse.json({
|
|
||||||
error: "The provided keys are a mismatch. If you rotated your keys, we are not aware of it.",
|
|
||||||
code: "INCORRECT_KEYS",
|
|
||||||
}, { status: 403 });
|
|
||||||
}
|
}
|
||||||
|
const nonce = (parsedPayload as { nonce?: string }).nonce;
|
||||||
// Verify Federation B (target) is known to us (prevents open-relay abuse)
|
return NextResponse.json({ method: "PROXY_RESPONSE" as PROXY_METHOD, status: "pong", nonce }, { status: 200 });
|
||||||
const targetBaseUrl = new URL(proxiedData.targetUrl.toString()).origin;
|
|
||||||
const [target] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, targetBaseUrl));
|
|
||||||
|
|
||||||
if (!target) {
|
|
||||||
debug("POST /proxy – target not found in registry: %s", targetBaseUrl);
|
|
||||||
debug("POST /proxy - Starting discovery process")
|
|
||||||
await discoverAndRegister(targetBaseUrl);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Proxy the request to Federation B as a TARGETED request (no proxy fallback — we ARE the proxy)
|
|
||||||
let forwardResponse: Response;
|
|
||||||
try {
|
|
||||||
const result = await federationFetch(proxiedData.targetUrl.toString(), {
|
|
||||||
method: "POST",
|
|
||||||
body: JSON.stringify({
|
|
||||||
method: "TARGETED" as PROXY_METHOD,
|
|
||||||
payload: proxiedData.payload,
|
|
||||||
}),
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Federation-Origin": process.env.BETTER_AUTH_URL!,
|
|
||||||
"Origin": process.env.BETTER_AUTH_URL!,
|
|
||||||
"X-Federation-Sender": getFedUrl,
|
|
||||||
},
|
|
||||||
serverUrl: targetBaseUrl,
|
|
||||||
proxyFallback: false,
|
|
||||||
skipHealthUpdate: true,
|
|
||||||
});
|
|
||||||
forwardResponse = result.response;
|
|
||||||
} catch (err) {
|
|
||||||
if (err instanceof FederationError) {
|
|
||||||
debug("POST /proxy – federation error proxying to %s: %s", proxiedData.targetUrl.toString(), err.code);
|
|
||||||
return NextResponse.json({ error: "Failed to proxy request", code: "FAILED_TO_PROXY_REQUEST", federationError: err.code, method: "PROXY_RESPONSE" as PROXY_METHOD }, { status: 502 });
|
|
||||||
}
|
|
||||||
throw err;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!forwardResponse.ok) {
|
|
||||||
debug("POST /proxy – error proxying request to %s: %s", proxiedData.targetUrl.toString(), forwardResponse.statusText);
|
|
||||||
return NextResponse.json({ error: "Failed to proxy request", code: "FAILED_TO_PROXY_REQUEST", details: await forwardResponse.json(), method: "PROXY_RESPONSE" as PROXY_METHOD }, { status: 502 });
|
|
||||||
}
|
|
||||||
|
|
||||||
const responseBody = await forwardResponse.json();
|
|
||||||
|
|
||||||
// Return the response from Federation B as a PROXY_RESPONSE
|
|
||||||
return NextResponse.json({
|
|
||||||
method: "PROXY_RESPONSE" as PROXY_METHOD,
|
|
||||||
payload: responseBody,
|
|
||||||
});
|
|
||||||
|
|
||||||
} catch (error) {
|
|
||||||
debug("POST /proxy – error parsing proxied data from %s: %s", request.url, error);
|
|
||||||
return NextResponse.json({ error: "Invalid proxied data", code: "INVALID_PROXY_DATA" }, { status: 400 });
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
case "TARGETED": {
|
|
||||||
try {
|
|
||||||
// 🚨 we've been targeted, the 🧃 are coming, everyone to the bunkers! 🚨
|
|
||||||
|
|
||||||
// We need to use the EncryptedEnvelopeBaseSchema here because we do not know what we are being targeted for
|
const payloadSchema = z.object({
|
||||||
// This is the information we'll have at the end of the day:
|
targetUrl: z.url(),
|
||||||
// - The requester's url
|
method: z.string(),
|
||||||
// - The requester's public signing key
|
headers: z.record(z.string(), z.string()),
|
||||||
// - The requester's public encryption key
|
body: z.string().transform((body) => {
|
||||||
// - The request data, being the method, path, and payload
|
const parsedBody = JSON.parse(body);
|
||||||
|
return {
|
||||||
if (!parsed.data.payload) {
|
method: parsedBody.method,
|
||||||
debug("POST /proxy – error parsing targeted data from %s: %s", request.url, "Missing payload");
|
payload: parsedBody.payload,
|
||||||
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_TARGETED_DATA" }, { status: 400 });
|
signature: parsedBody.signature,
|
||||||
}
|
};
|
||||||
|
})
|
||||||
const decryptedPayload = decryptPayload(parsed.data.payload, getOwnEncryptionSecretKey());
|
}).superRefine((data, ctx) => {
|
||||||
const parsedPayload = JSON.parse(decryptedPayload);
|
try {
|
||||||
|
const originPayloadHeaders = data.headers;
|
||||||
debug("POST /proxy – parsed targeted data from %s: %o", request.url, parsedPayload);
|
debug("POST /proxy – origin payload headers: %o", originPayloadHeaders);
|
||||||
|
if (!originPayloadHeaders["X-Federation-Target"] || !originPayloadHeaders["X-Federation-Origin"] || !originPayloadHeaders["Origin"]) {
|
||||||
const payloadSchema = z.object({
|
ctx.addIssue({ code: "custom", message: "Missing headers" });
|
||||||
targetUrl: z.url(),
|
|
||||||
method: z.string(),
|
|
||||||
headers: z.record(z.string(), z.string()),
|
|
||||||
body: z.string().transform((body) => {
|
|
||||||
const parsedBody = JSON.parse(body);
|
|
||||||
return {
|
|
||||||
method: parsedBody.method,
|
|
||||||
payload: parsedBody.payload,
|
|
||||||
signature: parsedBody.signature,
|
|
||||||
};
|
|
||||||
})
|
|
||||||
}).superRefine((data, ctx) => {
|
|
||||||
try {
|
|
||||||
const originPayloadHeaders = data.headers;
|
|
||||||
debug("POST /proxy – origin payload headers: %o", originPayloadHeaders);
|
|
||||||
if (!originPayloadHeaders["X-Federation-Target"] || !originPayloadHeaders["X-Federation-Origin"] || !originPayloadHeaders["Origin"]) {
|
|
||||||
ctx.addIssue({ code: "custom", message: "Missing headers" });
|
|
||||||
return z.NEVER;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Should be the base URL of the target URL
|
|
||||||
const targetUrl = new URL(data.targetUrl).origin;
|
|
||||||
const federationTargetOriginHeader = new URL(originPayloadHeaders["X-Federation-Target"]).origin;
|
|
||||||
debug("POST /proxy – target URL: %s", targetUrl);
|
|
||||||
debug("POST /proxy – x-federation-target header: %s", federationTargetOriginHeader);
|
|
||||||
if (federationTargetOriginHeader !== targetUrl) {
|
|
||||||
ctx.addIssue({ code: "custom", message: "x-federation-target header mismatch" });
|
|
||||||
return z.NEVER;
|
|
||||||
}
|
|
||||||
} catch (error) {
|
|
||||||
ctx.addIssue({ code: "custom", message: "Decryption failed" });
|
|
||||||
return z.NEVER;
|
return z.NEVER;
|
||||||
}
|
}
|
||||||
});
|
|
||||||
|
|
||||||
const validated = payloadSchema.safeParse(parsedPayload);
|
// Should be the base URL of the target URL
|
||||||
if (!validated.success) {
|
const targetUrl = new URL(data.targetUrl).origin;
|
||||||
debug("POST /proxy – error validating targeted data from %s: %s", request.url, validated.error.message);
|
const federationTargetOriginHeader = new URL(originPayloadHeaders["X-Federation-Target"]).origin;
|
||||||
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_TARGETED_DATA" }, { status: 400 });
|
debug("POST /proxy – target URL: %s", targetUrl);
|
||||||
|
debug("POST /proxy – x-federation-target header: %s", federationTargetOriginHeader);
|
||||||
|
if (federationTargetOriginHeader !== targetUrl) {
|
||||||
|
ctx.addIssue({ code: "custom", message: "x-federation-target header mismatch" });
|
||||||
|
return z.NEVER;
|
||||||
|
}
|
||||||
|
} catch (error) {
|
||||||
|
ctx.addIssue({ code: "custom", message: "Decryption failed" });
|
||||||
|
return z.NEVER;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
const validated = payloadSchema.safeParse(parsedPayload);
|
||||||
|
if (!validated.success) {
|
||||||
|
debug("POST /proxy – error validating targeted data from %s: %s", request.url, validated.error.message);
|
||||||
|
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_TARGETED_DATA" }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const { targetUrl, method, headers, body } = validated.data;
|
||||||
|
|
||||||
|
// Check if the sender is known, keys match and is not blackisted
|
||||||
|
const result = await db.transaction(async (tx) => {
|
||||||
|
|
||||||
|
const senderUrl = headers["X-Federation-Origin"];
|
||||||
|
// Check if the sender is blacklisted
|
||||||
|
const [blacklisted] = await tx.select().from(blacklistedServers).where(eq(blacklistedServers.serverUrl, senderUrl));
|
||||||
|
if (blacklisted) {
|
||||||
|
debug("POST /proxy – sender is blacklisted: %s", senderUrl);
|
||||||
|
return { error: "The federation server was blacklisted from interacting with this federation server. Please contact support to unblacklist your server.", code: "BLACKLISTED_FEDERATION_SERVER", action: undefined, status: 403 };
|
||||||
}
|
}
|
||||||
|
|
||||||
const { targetUrl, method, headers, body } = validated.data;
|
// Check if the sender is known
|
||||||
|
const [sender] = await tx.select().from(serverRegistry).where(eq(serverRegistry.url, senderUrl));
|
||||||
|
if (!sender) {
|
||||||
|
debug("POST /proxy – sender not found in registry: %s", senderUrl);
|
||||||
|
return { error: "Unknown federation server. Please redo the discovery process and try again.", code: "UNKNOWN_FEDERATION_SERVER_INTERACTION", action: undefined, status: 403 };
|
||||||
|
}
|
||||||
|
|
||||||
// Check if the sender is known, keys match and is not blackisted
|
let consolidatedFollowPayload: z.infer<typeof FollowEnvelopeSchema> | null = null;
|
||||||
const result = await db.transaction(async (tx) => {
|
let consolidatedPostPayload: z.infer<typeof PostEnvelopeSchema> | null = null;
|
||||||
|
let action: Actions;
|
||||||
const senderUrl = headers["X-Federation-Origin"];
|
switch (true) {
|
||||||
// Check if the sender is blacklisted
|
case targetUrl.includes("/api/auth/social/follows") && body.method === "FEDERATE": {
|
||||||
const [blacklisted] = await tx.select().from(blacklistedServers).where(eq(blacklistedServers.serverUrl, senderUrl));
|
debug("POST /proxy – parsing follow payload: %s", body.payload);
|
||||||
if (blacklisted) {
|
const payload = FollowEnvelopeSchema.safeParse(body.payload);
|
||||||
debug("POST /proxy – sender is blacklisted: %s", senderUrl);
|
if (!payload.success) {
|
||||||
return { error: "The federation server was blacklisted from interacting with this federation server. Please contact support to unblacklist your server.", code: "BLACKLISTED_FEDERATION_SERVER", action: undefined, status: 403 };
|
debug("POST /proxy – error parsing follow payload: %s", body.payload);
|
||||||
}
|
return { error: "Invalid follow payload", code: "INVALID_FOLLOW_PAYLOAD", action: undefined, status: 400 };
|
||||||
|
|
||||||
// Check if the sender is known
|
|
||||||
const [sender] = await tx.select().from(serverRegistry).where(eq(serverRegistry.url, senderUrl));
|
|
||||||
if (!sender) {
|
|
||||||
debug("POST /proxy – sender not found in registry: %s", senderUrl);
|
|
||||||
return { error: "Unknown federation server. Please redo the discovery process and try again.", code: "UNKNOWN_FEDERATION_SERVER_INTERACTION", action: undefined, status: 403 };
|
|
||||||
}
|
|
||||||
|
|
||||||
let consolidatedFollowPayload: z.infer<typeof FollowEnvelopeSchema> | null = null;
|
|
||||||
let consolidatedPostPayload: z.infer<typeof PostEnvelopeSchema> | null = null;
|
|
||||||
let action: Actions;
|
|
||||||
switch (true) {
|
|
||||||
case targetUrl.includes("/api/auth/social/follows") && body.method === "FEDERATE": {
|
|
||||||
debug("POST /proxy – parsing follow payload: %s", body.payload);
|
|
||||||
const payload = FollowEnvelopeSchema.safeParse(body.payload);
|
|
||||||
if (!payload.success) {
|
|
||||||
debug("POST /proxy – error parsing follow payload: %s", body.payload);
|
|
||||||
return { error: "Invalid follow payload", code: "INVALID_FOLLOW_PAYLOAD", action: undefined, status: 400 };
|
|
||||||
}
|
|
||||||
consolidatedFollowPayload = payload.data;
|
|
||||||
action = "FEDERATE_FOLLOW";
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
case targetUrl.includes("/api/auth/social/posts") && body.method === "FEDERATE_POST": {
|
|
||||||
debug("POST /proxy – parsing federated post payload");
|
|
||||||
const payload = PostEnvelopeSchema.safeParse(body.payload);
|
|
||||||
if (!payload.success) {
|
|
||||||
debug("POST /proxy – error parsing federated post payload: %s", payload.error.message);
|
|
||||||
return { error: "Invalid federated post payload", code: "INVALID_FEDERATED_POST_PAYLOAD", action: undefined, status: 400 };
|
|
||||||
}
|
|
||||||
consolidatedPostPayload = payload.data;
|
|
||||||
action = "FEDERATE_POST";
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
default: {
|
|
||||||
debug("POST /proxy – no endpoint specific parsing, rejecting request");
|
|
||||||
return { error: "Invalid payload", code: "INVALID_PAYLOAD", action: undefined, status: 400 };
|
|
||||||
}
|
}
|
||||||
|
consolidatedFollowPayload = payload.data;
|
||||||
|
action = "FEDERATE_FOLLOW";
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
|
case targetUrl.includes("/api/auth/social/posts") && body.method === "FEDERATE_POST": {
|
||||||
const signedEnvelope = consolidatedFollowPayload ?? consolidatedPostPayload;
|
debug("POST /proxy – parsing federated post payload");
|
||||||
if (!signedEnvelope) {
|
const payload = PostEnvelopeSchema.safeParse(body.payload);
|
||||||
|
if (!payload.success) {
|
||||||
|
debug("POST /proxy – error parsing federated post payload: %s", payload.error.message);
|
||||||
|
return { error: "Invalid federated post payload", code: "INVALID_FEDERATED_POST_PAYLOAD", action: undefined, status: 400 };
|
||||||
|
}
|
||||||
|
consolidatedPostPayload = payload.data;
|
||||||
|
action = "FEDERATE_POST";
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
default: {
|
||||||
|
debug("POST /proxy – no endpoint specific parsing, rejecting request");
|
||||||
return { error: "Invalid payload", code: "INVALID_PAYLOAD", action: undefined, status: 400 };
|
return { error: "Invalid payload", code: "INVALID_PAYLOAD", action: undefined, status: 400 };
|
||||||
}
|
}
|
||||||
|
|
||||||
// Check if the signature is valid
|
|
||||||
const senderPublicKey = new Uint8Array(Buffer.from(sender.publicKey, "base64"));
|
|
||||||
const senderEncryptionPublicKey = new Uint8Array(Buffer.from(sender.encryptionPublicKey, "base64"));
|
|
||||||
if (!verifySignature(signedEnvelope._raw, body.signature, senderPublicKey)) {
|
|
||||||
debug("POST /proxy – sender signature is invalid: %s", targetUrl);
|
|
||||||
return { error: "The provided signature is invalid. Please redo the discovery process and try again.", code: "INVALID_SIGNATURE", action: undefined, status: 403 };
|
|
||||||
}
|
|
||||||
|
|
||||||
debug("POST /proxy – sender is known, keys match and is not blackisted: %s", targetUrl);
|
|
||||||
|
|
||||||
// Now we can assume that:
|
|
||||||
// - The sender is known to us
|
|
||||||
// - The sender is not blacklisted
|
|
||||||
// - The signature is valid with what we have in the payload
|
|
||||||
// - The payload is a valid action and has a valid payload
|
|
||||||
// - There is a known endpoint for the action
|
|
||||||
// Now the only thing left is to handle the action. This cannot be done in a worker since we need to return a response to the proxy server. This could eventually overload this endpoint and cause issues, but it's not something I can fix right now.
|
|
||||||
|
|
||||||
switch (action) {
|
|
||||||
case "FEDERATE_FOLLOW": {
|
|
||||||
const followEnv = consolidatedFollowPayload!;
|
|
||||||
debug("POST /proxy – federating follow: %s", followEnv);
|
|
||||||
|
|
||||||
// We can do the follow procedure
|
|
||||||
// First check if the user exists
|
|
||||||
const [targetUser] = await tx.select().from(user).where(eq(user.id, followEnv.following.followingId));
|
|
||||||
if (!targetUser) {
|
|
||||||
debug("POST /proxy – target user not found: %s", followEnv.following.followingId);
|
|
||||||
return { error: "The user you are trying to follow does not exist.", code: "USER_NOT_FOUND", status: 404 };
|
|
||||||
}
|
|
||||||
|
|
||||||
// Second check if the follow already exists
|
|
||||||
const [existingFollow] = await tx.select().from(follows).where(and(
|
|
||||||
eq(follows.followerId, followEnv.following.followerId),
|
|
||||||
eq(follows.followingId, followEnv.following.followingId),
|
|
||||||
));
|
|
||||||
|
|
||||||
if (existingFollow) {
|
|
||||||
debug("POST /proxy – follow already exists: %s", existingFollow.id);
|
|
||||||
return { error: "You are already following this user.", code: "FOLLOW_ALREADY_EXISTS", status: 409 };
|
|
||||||
}
|
|
||||||
|
|
||||||
// Third check if the user is private
|
|
||||||
const isPrivate = !targetUser.isPrivate;
|
|
||||||
|
|
||||||
const following = await tx.insert(follows).values({
|
|
||||||
id: crypto.randomUUID(),
|
|
||||||
followerId: followEnv.following.followerId,
|
|
||||||
followingId: followEnv.following.followingId,
|
|
||||||
accepted: isPrivate,
|
|
||||||
createdAt: new Date(),
|
|
||||||
followerServerUrl: peerRegistryUrlOrNull(senderUrl),
|
|
||||||
followingServerUrl: peerRegistryUrlOrNull(targetUrl),
|
|
||||||
acknowledged: true,
|
|
||||||
}).returning();
|
|
||||||
|
|
||||||
const row = following[0];
|
|
||||||
// Same plaintext shape as the delivery job payload / FollowInnerPayloadSchema (see federation worker).
|
|
||||||
const innerPayload = JSON.stringify({
|
|
||||||
following: {
|
|
||||||
id: row.id,
|
|
||||||
createdAt: row.createdAt,
|
|
||||||
followerId: row.followerId,
|
|
||||||
followingId: row.followingId,
|
|
||||||
accepted: row.accepted,
|
|
||||||
followerServerUrl: row.followerServerUrl,
|
|
||||||
acknowledged: row.acknowledged
|
|
||||||
},
|
|
||||||
federationUrl: senderUrl,
|
|
||||||
method: "FEDERATE" as const,
|
|
||||||
});
|
|
||||||
const signature = signMessage(innerPayload, getOwnSigningSecretKey());
|
|
||||||
|
|
||||||
return { innerPayload, signature, senderEncryptionPublicKey };
|
|
||||||
}
|
|
||||||
case "FEDERATE_POST": {
|
|
||||||
const postEnv = consolidatedPostPayload!;
|
|
||||||
const postResult = await applyFederatedPostInTransaction(tx, postEnv, body.signature, {
|
|
||||||
publicKey: sender.publicKey,
|
|
||||||
encryptionPublicKey: sender.encryptionPublicKey,
|
|
||||||
url: sender.url,
|
|
||||||
});
|
|
||||||
if (!postResult.ok) {
|
|
||||||
return {
|
|
||||||
error: postResult.error,
|
|
||||||
code: postResult.code,
|
|
||||||
action: undefined,
|
|
||||||
status: postResult.status,
|
|
||||||
};
|
|
||||||
}
|
|
||||||
const encKey = new Uint8Array(Buffer.from(postResult.senderEncryptionPublicKeyB64, "base64"));
|
|
||||||
return {
|
|
||||||
innerPayload: postResult.innerPayload,
|
|
||||||
signature: postResult.signature,
|
|
||||||
senderEncryptionPublicKey: encKey,
|
|
||||||
};
|
|
||||||
}
|
|
||||||
default: {
|
|
||||||
debug("POST /proxy – no action specific handling, rejecting request");
|
|
||||||
return { error: "Invalid action", code: "INVALID_ACTION", action: undefined, status: 400 };
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
});
|
|
||||||
|
|
||||||
if (result.error) {
|
|
||||||
return NextResponse.json({ error: result.error, code: result.code, action: result.action, status: result.status }, { status: result.status });
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return NextResponse.json({
|
const signedEnvelope = consolidatedFollowPayload ?? consolidatedPostPayload;
|
||||||
method: "PROXY_RESPONSE" as PROXY_METHOD,
|
if (!signedEnvelope) {
|
||||||
status: "acknowledged",
|
return { error: "Invalid payload", code: "INVALID_PAYLOAD", action: undefined, status: 400 };
|
||||||
data: encryptPayload(result.innerPayload!, result.senderEncryptionPublicKey!),
|
}
|
||||||
signature: result.signature,
|
|
||||||
}, { status: 200 });
|
|
||||||
|
|
||||||
} catch (error) {
|
// Check if the signature is valid
|
||||||
debug("POST /proxy – error parsing targeted data from %s: %s", request.url, error);
|
const senderPublicKey = new Uint8Array(Buffer.from(sender.publicKey, "base64"));
|
||||||
return NextResponse.json({ error: "Invalid targeted data", code: "INVALID_PROXY_DATA" }, { status: 400 });
|
const senderEncryptionPublicKey = new Uint8Array(Buffer.from(sender.encryptionPublicKey, "base64"));
|
||||||
|
if (!verifySignature(signedEnvelope._raw, body.signature, senderPublicKey)) {
|
||||||
|
debug("POST /proxy – sender signature is invalid: %s", targetUrl);
|
||||||
|
return { error: "The provided signature is invalid. Please redo the discovery process and try again.", code: "INVALID_SIGNATURE", action: undefined, status: 403 };
|
||||||
|
}
|
||||||
|
|
||||||
|
debug("POST /proxy – sender is known, keys match and is not blackisted: %s", targetUrl);
|
||||||
|
|
||||||
|
// Now we can assume that:
|
||||||
|
// - The sender is known to us
|
||||||
|
// - The sender is not blacklisted
|
||||||
|
// - The signature is valid with what we have in the payload
|
||||||
|
// - The payload is a valid action and has a valid payload
|
||||||
|
// - There is a known endpoint for the action
|
||||||
|
// Now the only thing left is to handle the action. This cannot be done in a worker since we need to return a response to the proxy server. This could eventually overload this endpoint and cause issues, but it's not something I can fix right now.
|
||||||
|
|
||||||
|
switch (action) {
|
||||||
|
case "FEDERATE_FOLLOW": {
|
||||||
|
const followEnv = consolidatedFollowPayload!;
|
||||||
|
debug("POST /proxy – federating follow: %s", followEnv);
|
||||||
|
|
||||||
|
// We can do the follow procedure
|
||||||
|
// First check if the user exists
|
||||||
|
const [targetUser] = await tx.select().from(user).where(eq(user.id, followEnv.following.followingId));
|
||||||
|
if (!targetUser) {
|
||||||
|
debug("POST /proxy – target user not found: %s", followEnv.following.followingId);
|
||||||
|
return { error: "The user you are trying to follow does not exist.", code: "USER_NOT_FOUND", status: 404 };
|
||||||
|
}
|
||||||
|
|
||||||
|
// Second check if the follow already exists
|
||||||
|
const [existingFollow] = await tx.select().from(follows).where(and(
|
||||||
|
eq(follows.followerId, followEnv.following.followerId),
|
||||||
|
eq(follows.followingId, followEnv.following.followingId),
|
||||||
|
));
|
||||||
|
|
||||||
|
if (existingFollow) {
|
||||||
|
debug("POST /proxy – follow already exists: %s", existingFollow.id);
|
||||||
|
return { error: "You are already following this user.", code: "FOLLOW_ALREADY_EXISTS", status: 409 };
|
||||||
|
}
|
||||||
|
|
||||||
|
// Reject if the target user has blocked the remote follower.
|
||||||
|
const [followBlock] = await tx.select({ id: blocks.id }).from(blocks).where(and(
|
||||||
|
eq(blocks.blockerId, followEnv.following.followingId),
|
||||||
|
eq(blocks.blockedUserId, followEnv.following.followerId),
|
||||||
|
)).limit(1);
|
||||||
|
|
||||||
|
if (followBlock) {
|
||||||
|
debug("POST /proxy – target user has blocked the follower");
|
||||||
|
return { error: "Unable to follow this user.", code: "USER_BLOCKED", status: 403 };
|
||||||
|
}
|
||||||
|
|
||||||
|
// Third check if the user is private
|
||||||
|
const isPrivate = !targetUser.isPrivate;
|
||||||
|
|
||||||
|
const following = await tx.insert(follows).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
followerId: followEnv.following.followerId,
|
||||||
|
followingId: followEnv.following.followingId,
|
||||||
|
accepted: isPrivate,
|
||||||
|
createdAt: new Date(),
|
||||||
|
followerServerUrl: peerRegistryUrlOrNull(senderUrl),
|
||||||
|
followingServerUrl: peerRegistryUrlOrNull(targetUrl),
|
||||||
|
acknowledged: true,
|
||||||
|
}).returning();
|
||||||
|
|
||||||
|
const row = following[0];
|
||||||
|
// Same plaintext shape as the delivery job payload / FollowInnerPayloadSchema (see federation worker).
|
||||||
|
const innerPayload = JSON.stringify({
|
||||||
|
following: {
|
||||||
|
id: row.id,
|
||||||
|
createdAt: row.createdAt,
|
||||||
|
followerId: row.followerId,
|
||||||
|
followingId: row.followingId,
|
||||||
|
accepted: row.accepted,
|
||||||
|
followerServerUrl: row.followerServerUrl,
|
||||||
|
acknowledged: row.acknowledged
|
||||||
|
},
|
||||||
|
federationUrl: senderUrl,
|
||||||
|
method: "FEDERATE" as const,
|
||||||
|
});
|
||||||
|
const signature = signMessage(innerPayload, getOwnSigningSecretKey());
|
||||||
|
|
||||||
|
return { innerPayload, signature, senderEncryptionPublicKey };
|
||||||
|
}
|
||||||
|
case "FEDERATE_POST": {
|
||||||
|
const postEnv = consolidatedPostPayload!;
|
||||||
|
const postResult = await applyFederatedPostInTransaction(tx, postEnv, body.signature, {
|
||||||
|
publicKey: sender.publicKey,
|
||||||
|
encryptionPublicKey: sender.encryptionPublicKey,
|
||||||
|
url: sender.url,
|
||||||
|
});
|
||||||
|
if (!postResult.ok) {
|
||||||
|
return {
|
||||||
|
error: postResult.error,
|
||||||
|
code: postResult.code,
|
||||||
|
action: undefined,
|
||||||
|
status: postResult.status,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
const encKey = new Uint8Array(Buffer.from(postResult.senderEncryptionPublicKeyB64, "base64"));
|
||||||
|
return {
|
||||||
|
innerPayload: postResult.innerPayload,
|
||||||
|
signature: postResult.signature,
|
||||||
|
senderEncryptionPublicKey: encKey,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
default: {
|
||||||
|
debug("POST /proxy – no action specific handling, rejecting request");
|
||||||
|
return { error: "Invalid action", code: "INVALID_ACTION", action: undefined, status: 400 };
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
});
|
||||||
|
|
||||||
|
if (result.error) {
|
||||||
|
return NextResponse.json({ error: result.error, code: result.code, action: result.action, status: result.status }, { status: result.status });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return NextResponse.json({
|
||||||
|
method: "PROXY_RESPONSE" as PROXY_METHOD,
|
||||||
|
status: "acknowledged",
|
||||||
|
data: encryptPayload(result.innerPayload!, result.senderEncryptionPublicKey!),
|
||||||
|
signature: result.signature,
|
||||||
|
}, { status: 200 });
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
@ -1,95 +0,0 @@
|
||||||
import { Button } from "@/components/ui/button"
|
|
||||||
import {
|
|
||||||
Card,
|
|
||||||
CardContent,
|
|
||||||
CardDescription,
|
|
||||||
CardHeader,
|
|
||||||
CardTitle,
|
|
||||||
} from "@/components/ui/card"
|
|
||||||
import {
|
|
||||||
Field,
|
|
||||||
FieldDescription,
|
|
||||||
FieldGroup,
|
|
||||||
FieldLabel,
|
|
||||||
FieldSeparator,
|
|
||||||
} from "@/components/ui/field"
|
|
||||||
import { Input } from "@/components/ui/input"
|
|
||||||
import { cn } from "@/lib/utils"
|
|
||||||
|
|
||||||
export function LoginForm({
|
|
||||||
className,
|
|
||||||
...props
|
|
||||||
}: React.ComponentProps<"div">) {
|
|
||||||
return (
|
|
||||||
<div className={cn("flex flex-col gap-6", className)} {...props}>
|
|
||||||
<Card>
|
|
||||||
<CardHeader className="text-center">
|
|
||||||
<CardTitle className="text-xl">Welcome back</CardTitle>
|
|
||||||
<CardDescription>
|
|
||||||
Login with your Apple or Google account
|
|
||||||
</CardDescription>
|
|
||||||
</CardHeader>
|
|
||||||
<CardContent>
|
|
||||||
<form>
|
|
||||||
<FieldGroup>
|
|
||||||
<Field>
|
|
||||||
<Button variant="outline" type="button">
|
|
||||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
|
|
||||||
<path
|
|
||||||
d="M12.152 6.896c-.948 0-2.415-1.078-3.96-1.04-2.04.027-3.91 1.183-4.961 3.014-2.117 3.675-.546 9.103 1.519 12.09 1.013 1.454 2.208 3.09 3.792 3.039 1.52-.065 2.09-.987 3.935-.987 1.831 0 2.35.987 3.96.948 1.637-.026 2.676-1.48 3.676-2.948 1.156-1.688 1.636-3.325 1.662-3.415-.039-.013-3.182-1.221-3.22-4.857-.026-3.04 2.48-4.494 2.597-4.559-1.429-2.09-3.623-2.324-4.39-2.376-2-.156-3.675 1.09-4.61 1.09zM15.53 3.83c.843-1.012 1.4-2.427 1.245-3.83-1.207.052-2.662.805-3.532 1.818-.78.896-1.454 2.338-1.273 3.714 1.338.104 2.715-.688 3.559-1.701"
|
|
||||||
fill="currentColor"
|
|
||||||
/>
|
|
||||||
</svg>
|
|
||||||
Login with Apple
|
|
||||||
</Button>
|
|
||||||
<Button variant="outline" type="button">
|
|
||||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
|
|
||||||
<path
|
|
||||||
d="M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z"
|
|
||||||
fill="currentColor"
|
|
||||||
/>
|
|
||||||
</svg>
|
|
||||||
Login with Google
|
|
||||||
</Button>
|
|
||||||
</Field>
|
|
||||||
<FieldSeparator className="*:data-[slot=field-separator-content]:bg-card">
|
|
||||||
Or continue with
|
|
||||||
</FieldSeparator>
|
|
||||||
<Field>
|
|
||||||
<FieldLabel htmlFor="email">Email</FieldLabel>
|
|
||||||
<Input
|
|
||||||
id="email"
|
|
||||||
type="email"
|
|
||||||
placeholder="m@example.com"
|
|
||||||
required
|
|
||||||
/>
|
|
||||||
</Field>
|
|
||||||
<Field>
|
|
||||||
<div className="flex items-center">
|
|
||||||
<FieldLabel htmlFor="password">Password</FieldLabel>
|
|
||||||
<a
|
|
||||||
href="#"
|
|
||||||
className="ml-auto text-sm underline-offset-4 hover:underline"
|
|
||||||
>
|
|
||||||
Forgot your password?
|
|
||||||
</a>
|
|
||||||
</div>
|
|
||||||
<Input id="password" type="password" required />
|
|
||||||
</Field>
|
|
||||||
<Field>
|
|
||||||
<Button type="submit">Login</Button>
|
|
||||||
<FieldDescription className="text-center">
|
|
||||||
Don't have an account? <a href="#">Sign up</a>
|
|
||||||
</FieldDescription>
|
|
||||||
</Field>
|
|
||||||
</FieldGroup>
|
|
||||||
</form>
|
|
||||||
</CardContent>
|
|
||||||
</Card>
|
|
||||||
<FieldDescription className="px-6 text-center">
|
|
||||||
By clicking continue, you agree to our <a href="#">Terms of Service</a>{" "}
|
|
||||||
and <a href="#">Privacy Policy</a>.
|
|
||||||
</FieldDescription>
|
|
||||||
</div>
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
@ -13,6 +13,7 @@ import { Button } from "../ui/button";
|
||||||
import { Dialog, DialogContent, DialogHeader, DialogTitle } from "../ui/dialog";
|
import { Dialog, DialogContent, DialogHeader, DialogTitle } from "../ui/dialog";
|
||||||
import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "../ui/form";
|
import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "../ui/form";
|
||||||
import { Input } from "../ui/input";
|
import { Input } from "../ui/input";
|
||||||
|
import IdentityBackup from "./IdentityBackup";
|
||||||
|
|
||||||
const createIdentityFormSchema = z.object({
|
const createIdentityFormSchema = z.object({
|
||||||
password: z
|
password: z
|
||||||
|
|
@ -44,6 +45,7 @@ const requirements = [
|
||||||
export default function CreateIdentity() {
|
export default function CreateIdentity() {
|
||||||
const [isOpen, setIsOpen] = useState(true);
|
const [isOpen, setIsOpen] = useState(true);
|
||||||
const [showPassword, setShowPassword] = useState(false);
|
const [showPassword, setShowPassword] = useState(false);
|
||||||
|
const [mnemonic, setMnemonic] = useState<string | null>(null);
|
||||||
const { data: session } = authClient.useSession();
|
const { data: session } = authClient.useSession();
|
||||||
const router = useRouter();
|
const router = useRouter();
|
||||||
|
|
||||||
|
|
@ -62,145 +64,153 @@ export default function CreateIdentity() {
|
||||||
if (!userId) return;
|
if (!userId) return;
|
||||||
|
|
||||||
try {
|
try {
|
||||||
const { mnemonic } = await authClient.createOvenIdentity(userId, values.password);
|
const result = await authClient.createOvenIdentity(userId, values.password);
|
||||||
console.log("[CreateIdentity]", mnemonic);
|
setMnemonic(result.mnemonic);
|
||||||
toast.success("Identity created successfully.");
|
|
||||||
setIsOpen(false);
|
|
||||||
router.refresh();
|
|
||||||
} catch (err) {
|
} catch (err) {
|
||||||
console.error("[CreateIdentity]", err);
|
console.error("[CreateIdentity]", err);
|
||||||
toast.error("Failed to create identity. Please try again.");
|
toast.error("Failed to create identity. Please try again.");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function handleBackupConfirmed() {
|
||||||
|
setIsOpen(false);
|
||||||
|
router.refresh();
|
||||||
|
}
|
||||||
|
|
||||||
return (
|
return (
|
||||||
<Dialog open={isOpen} onOpenChange={setIsOpen}>
|
<Dialog open={isOpen} onOpenChange={setIsOpen}>
|
||||||
<DialogContent onInteractOutside={(e) => e.preventDefault()} className="sm:max-w-md border-border bg-card p-0 overflow-hidden [&>button]:hidden">
|
<DialogContent onInteractOutside={(e) => e.preventDefault()} className="sm:max-w-md border-border bg-card p-0 overflow-hidden [&>button]:hidden">
|
||||||
<div className="px-6 pt-6 pb-2 border-b border-border/60">
|
{mnemonic ? (
|
||||||
<div className="flex items-center gap-3 mb-3">
|
<IdentityBackup mnemonic={mnemonic} onConfirmed={handleBackupConfirmed} />
|
||||||
<div className="flex items-center justify-center w-8 h-8 rounded bg-primary/10 border border-primary/20">
|
) : (
|
||||||
<KeyRound className="w-4 h-4 text-primary" />
|
<>
|
||||||
</div>
|
<div className="px-6 pt-6 pb-2 border-b border-border/60">
|
||||||
<span className="font-mono text-[10px] text-muted-foreground tracking-[0.25em] uppercase">
|
<div className="flex items-center gap-3 mb-3">
|
||||||
Identity Setup
|
<div className="flex items-center justify-center w-8 h-8 rounded bg-primary/10 border border-primary/20">
|
||||||
</span>
|
<KeyRound className="w-4 h-4 text-primary" />
|
||||||
</div>
|
|
||||||
<DialogHeader className="text-left space-y-1">
|
|
||||||
<DialogTitle className="font-display text-3xl tracking-[0.06em] text-foreground">
|
|
||||||
Create your Sipher identity
|
|
||||||
</DialogTitle>
|
|
||||||
<p className="text-sm text-muted-foreground leading-relaxed">
|
|
||||||
This password encrypts your local identity key. It never leaves your device. <span className="font-bold">DO NOT FORGET THIS PASSWORD.</span>
|
|
||||||
</p>
|
|
||||||
<p className="text-sm text-muted-foreground leading-relaxed">
|
|
||||||
You may use the same password for your Sipher account and your identity, although it is not recommended.
|
|
||||||
</p>
|
|
||||||
</DialogHeader>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div className="px-6 py-5">
|
|
||||||
<Form {...form}>
|
|
||||||
<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-5">
|
|
||||||
<FormField
|
|
||||||
control={form.control}
|
|
||||||
name="password"
|
|
||||||
render={({ field }) => (
|
|
||||||
<FormItem className="space-y-1.5">
|
|
||||||
<FormLabel className="font-mono text-[11px] tracking-[0.15em] uppercase text-muted-foreground">
|
|
||||||
Master Password
|
|
||||||
</FormLabel>
|
|
||||||
<FormControl>
|
|
||||||
<div className="relative">
|
|
||||||
<Input
|
|
||||||
{...field}
|
|
||||||
type={showPassword ? "text" : "password"}
|
|
||||||
className="h-11 text-base bg-background border-border/60 pr-10 focus-visible:ring-primary/50 focus-visible:border-primary/50"
|
|
||||||
placeholder="••••••••••••"
|
|
||||||
/>
|
|
||||||
<button
|
|
||||||
type="button"
|
|
||||||
onClick={() => setShowPassword((v) => !v)}
|
|
||||||
className="absolute right-3 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground transition-colors"
|
|
||||||
tabIndex={-1}
|
|
||||||
>
|
|
||||||
{showPassword
|
|
||||||
? <EyeOff className="w-4 h-4" />
|
|
||||||
: <Eye className="w-4 h-4" />
|
|
||||||
}
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
</FormControl>
|
|
||||||
<FormMessage className="font-mono text-[10px] tracking-wide" />
|
|
||||||
</FormItem>
|
|
||||||
)}
|
|
||||||
/>
|
|
||||||
|
|
||||||
{password.length > 0 && (
|
|
||||||
<div className="space-y-1.5">
|
|
||||||
<span className="font-mono text-[10px] tracking-[0.15em] uppercase text-muted-foreground">
|
|
||||||
Requirements
|
|
||||||
</span>
|
|
||||||
<ul className="grid grid-cols-2 gap-x-4 gap-y-1">
|
|
||||||
{requirements.map((req) => {
|
|
||||||
const met = req.test(password);
|
|
||||||
return (
|
|
||||||
<li
|
|
||||||
key={req.label}
|
|
||||||
className={`font-mono text-[10px] tracking-wide flex items-center gap-1.5 transition-colors ${met ? "text-primary" : "text-muted-foreground/60"}`}
|
|
||||||
>
|
|
||||||
<span className={`inline-block w-1 h-1 rounded-full shrink-0 ${met ? "bg-primary" : "bg-border"}`} />
|
|
||||||
{req.label}
|
|
||||||
</li>
|
|
||||||
);
|
|
||||||
})}
|
|
||||||
</ul>
|
|
||||||
</div>
|
</div>
|
||||||
)}
|
<span className="font-mono text-[10px] text-muted-foreground tracking-[0.25em] uppercase">
|
||||||
|
Identity Setup
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
<DialogHeader className="text-left space-y-1">
|
||||||
|
<DialogTitle className="font-display text-3xl tracking-[0.06em] text-foreground">
|
||||||
|
Create your Sipher identity
|
||||||
|
</DialogTitle>
|
||||||
|
<p className="text-sm text-muted-foreground leading-relaxed">
|
||||||
|
This password encrypts your local identity key. It never leaves your device. <span className="font-bold">DO NOT FORGET THIS PASSWORD.</span>
|
||||||
|
</p>
|
||||||
|
<p className="text-sm text-muted-foreground leading-relaxed">
|
||||||
|
You may use the same password for your Sipher account and your identity, although it is not recommended.
|
||||||
|
</p>
|
||||||
|
</DialogHeader>
|
||||||
|
</div>
|
||||||
|
|
||||||
<Accordion type="single" collapsible className="border border-destructive/30 rounded bg-destructive/5">
|
<div className="px-6 py-5">
|
||||||
<AccordionItem value="lost-password" className="border-none">
|
<Form {...form}>
|
||||||
<AccordionTrigger className="px-3 py-2.5 hover:no-underline hover:bg-destructive/10 rounded transition-colors">
|
<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-5">
|
||||||
<span className="flex items-center gap-2 font-mono text-[10px] tracking-[0.15em] uppercase text-destructive/80">
|
<FormField
|
||||||
<TriangleAlert className="w-3.5 h-3.5 shrink-0" />
|
control={form.control}
|
||||||
What if I lose my password?
|
name="password"
|
||||||
</span>
|
render={({ field }) => (
|
||||||
</AccordionTrigger>
|
<FormItem className="space-y-1.5">
|
||||||
<AccordionContent className="px-3 pb-3 pt-0">
|
<FormLabel className="font-mono text-[11px] tracking-[0.15em] uppercase text-muted-foreground">
|
||||||
<ul className="space-y-1.5 font-mono text-[10px] tracking-wide text-muted-foreground leading-relaxed">
|
Master Password
|
||||||
<li className="flex gap-2">
|
</FormLabel>
|
||||||
<span className="text-destructive/60 shrink-0">—</span>
|
<FormControl>
|
||||||
Your identity key is encrypted locally with this password. There is no recovery mechanism.
|
<div className="relative">
|
||||||
</li>
|
<Input
|
||||||
<li className="flex gap-2">
|
{...field}
|
||||||
<span className="text-destructive/60 shrink-0">—</span>
|
type={showPassword ? "text" : "password"}
|
||||||
Losing it means permanent loss of access to your encrypted messages and posts.
|
className="h-11 text-base bg-background border-border/60 pr-10 focus-visible:ring-primary/50 focus-visible:border-primary/50"
|
||||||
</li>
|
placeholder="••••••••••••"
|
||||||
<li className="flex gap-2">
|
/>
|
||||||
<span className="text-destructive/60 shrink-0">—</span>
|
<button
|
||||||
Store it somewhere safe — a password manager or written offline.
|
type="button"
|
||||||
</li>
|
onClick={() => setShowPassword((v) => !v)}
|
||||||
<li className="flex gap-2">
|
className="absolute right-3 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground transition-colors"
|
||||||
<span className="text-destructive/60 shrink-0">—</span>
|
tabIndex={-1}
|
||||||
Losing your identity means that all your messages are permanently lost and your old posts won't hold a valid signature.
|
>
|
||||||
</li>
|
{showPassword
|
||||||
</ul>
|
? <EyeOff className="w-4 h-4" />
|
||||||
</AccordionContent>
|
: <Eye className="w-4 h-4" />
|
||||||
</AccordionItem>
|
}
|
||||||
</Accordion>
|
</button>
|
||||||
|
</div>
|
||||||
|
</FormControl>
|
||||||
|
<FormMessage className="font-mono text-[10px] tracking-wide" />
|
||||||
|
</FormItem>
|
||||||
|
)}
|
||||||
|
/>
|
||||||
|
|
||||||
<Button
|
{password.length > 0 && (
|
||||||
type="submit"
|
<div className="space-y-1.5">
|
||||||
className="w-full h-11 font-mono text-[11px] tracking-[0.2em] uppercase"
|
<span className="font-mono text-[10px] tracking-[0.15em] uppercase text-muted-foreground">
|
||||||
disabled={form.formState.isSubmitting || !passwordRequirementsMet}
|
Requirements
|
||||||
>
|
</span>
|
||||||
{form.formState.isSubmitting
|
<ul className="grid grid-cols-2 gap-x-4 gap-y-1">
|
||||||
? <Loader2 className="w-4 h-4 animate-spin" />
|
{requirements.map((req) => {
|
||||||
: "Generate Identity"
|
const met = req.test(password);
|
||||||
}
|
return (
|
||||||
</Button>
|
<li
|
||||||
</form>
|
key={req.label}
|
||||||
</Form>
|
className={`font-mono text-[10px] tracking-wide flex items-center gap-1.5 transition-colors ${met ? "text-primary" : "text-muted-foreground/60"}`}
|
||||||
</div>
|
>
|
||||||
|
<span className={`inline-block w-1 h-1 rounded-full shrink-0 ${met ? "bg-primary" : "bg-border"}`} />
|
||||||
|
{req.label}
|
||||||
|
</li>
|
||||||
|
);
|
||||||
|
})}
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
)}
|
||||||
|
|
||||||
|
<Accordion type="single" collapsible className="border border-destructive/30 rounded bg-destructive/5">
|
||||||
|
<AccordionItem value="lost-password" className="border-none">
|
||||||
|
<AccordionTrigger className="px-3 py-2.5 hover:no-underline hover:bg-destructive/10 rounded transition-colors">
|
||||||
|
<span className="flex items-center gap-2 font-mono text-[10px] tracking-[0.15em] uppercase text-destructive/80">
|
||||||
|
<TriangleAlert className="w-3.5 h-3.5 shrink-0" />
|
||||||
|
What if I lose my password?
|
||||||
|
</span>
|
||||||
|
</AccordionTrigger>
|
||||||
|
<AccordionContent className="px-3 pb-3 pt-0">
|
||||||
|
<ul className="space-y-1.5 font-mono text-[10px] tracking-wide text-muted-foreground leading-relaxed">
|
||||||
|
<li className="flex gap-2">
|
||||||
|
<span className="text-destructive/60 shrink-0">—</span>
|
||||||
|
Your identity key is encrypted locally with this password. There is no recovery mechanism.
|
||||||
|
</li>
|
||||||
|
<li className="flex gap-2">
|
||||||
|
<span className="text-destructive/60 shrink-0">—</span>
|
||||||
|
Losing it means permanent loss of access to your encrypted messages and posts.
|
||||||
|
</li>
|
||||||
|
<li className="flex gap-2">
|
||||||
|
<span className="text-destructive/60 shrink-0">—</span>
|
||||||
|
Store it somewhere safe — a password manager or written offline.
|
||||||
|
</li>
|
||||||
|
<li className="flex gap-2">
|
||||||
|
<span className="text-destructive/60 shrink-0">—</span>
|
||||||
|
Losing your identity means that all your messages are permanently lost and your old posts won't hold a valid signature.
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
</AccordionContent>
|
||||||
|
</AccordionItem>
|
||||||
|
</Accordion>
|
||||||
|
|
||||||
|
<Button
|
||||||
|
type="submit"
|
||||||
|
className="w-full h-11 font-mono text-[11px] tracking-[0.2em] uppercase"
|
||||||
|
disabled={form.formState.isSubmitting || !passwordRequirementsMet}
|
||||||
|
>
|
||||||
|
{form.formState.isSubmitting
|
||||||
|
? <Loader2 className="w-4 h-4 animate-spin" />
|
||||||
|
: "Generate Identity"
|
||||||
|
}
|
||||||
|
</Button>
|
||||||
|
</form>
|
||||||
|
</Form>
|
||||||
|
</div>
|
||||||
|
</>
|
||||||
|
)}
|
||||||
</DialogContent>
|
</DialogContent>
|
||||||
</Dialog>
|
</Dialog>
|
||||||
)
|
)
|
||||||
|
|
|
||||||
85
src/components/main/IdentityBackup.tsx
Normal file
85
src/components/main/IdentityBackup.tsx
Normal file
|
|
@ -0,0 +1,85 @@
|
||||||
|
"use client";
|
||||||
|
|
||||||
|
import { Button } from "@/components/ui/button";
|
||||||
|
import { Copy, ShieldCheck } from "lucide-react";
|
||||||
|
import { useState } from "react";
|
||||||
|
import { toast } from "sonner";
|
||||||
|
|
||||||
|
interface IdentityBackupProps {
|
||||||
|
mnemonic: string;
|
||||||
|
onConfirmed: () => void;
|
||||||
|
}
|
||||||
|
|
||||||
|
export default function IdentityBackup({ mnemonic, onConfirmed }: IdentityBackupProps) {
|
||||||
|
const [confirmed, setConfirmed] = useState(false);
|
||||||
|
|
||||||
|
function copyMnemonic() {
|
||||||
|
navigator.clipboard.writeText(mnemonic).then(() => {
|
||||||
|
toast.success("Mnemonic copied to clipboard.");
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
const words = mnemonic.split(" ");
|
||||||
|
|
||||||
|
return (
|
||||||
|
<div className="px-6 py-6 space-y-5">
|
||||||
|
<div className="flex items-center gap-3">
|
||||||
|
<div className="flex items-center justify-center w-8 h-8 rounded bg-primary/10 border border-primary/20">
|
||||||
|
<ShieldCheck className="w-4 h-4 text-primary" />
|
||||||
|
</div>
|
||||||
|
<span className="font-mono text-[10px] text-muted-foreground tracking-[0.25em] uppercase">
|
||||||
|
Backup your recovery phrase
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div className="space-y-1">
|
||||||
|
<p className="text-sm text-muted-foreground leading-relaxed">
|
||||||
|
This is the <span className="font-semibold text-foreground">only time</span> your recovery phrase will be shown. Write it down offline and keep it safe. It is the only way to recover your identity if you lose your master password.
|
||||||
|
</p>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div className="relative rounded border border-border bg-muted/40 p-4">
|
||||||
|
<div className="grid grid-cols-3 gap-x-4 gap-y-1.5">
|
||||||
|
{words.map((word, i) => (
|
||||||
|
<div key={i} className="flex items-center gap-1.5">
|
||||||
|
<span className="font-mono text-[10px] text-muted-foreground/60 w-4 text-right shrink-0">
|
||||||
|
{i + 1}.
|
||||||
|
</span>
|
||||||
|
<span className="font-mono text-[13px] text-foreground select-all">
|
||||||
|
{word}
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
))}
|
||||||
|
</div>
|
||||||
|
<button
|
||||||
|
type="button"
|
||||||
|
onClick={copyMnemonic}
|
||||||
|
className="absolute top-2 right-2 p-1.5 rounded text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
|
||||||
|
title="Copy recovery phrase"
|
||||||
|
>
|
||||||
|
<Copy className="w-3.5 h-3.5" />
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<label className="flex items-start gap-3 cursor-pointer select-none">
|
||||||
|
<input
|
||||||
|
type="checkbox"
|
||||||
|
checked={confirmed}
|
||||||
|
onChange={(e) => setConfirmed(e.target.checked)}
|
||||||
|
className="mt-0.5 h-4 w-4 shrink-0 rounded border-border accent-primary"
|
||||||
|
/>
|
||||||
|
<span className="font-mono text-[11px] text-muted-foreground leading-relaxed">
|
||||||
|
I have written down my recovery phrase and stored it somewhere safe. I understand this phrase will never be shown again.
|
||||||
|
</span>
|
||||||
|
</label>
|
||||||
|
|
||||||
|
<Button
|
||||||
|
onClick={onConfirmed}
|
||||||
|
disabled={!confirmed}
|
||||||
|
className="w-full h-11 font-mono text-[11px] tracking-[0.2em] uppercase"
|
||||||
|
>
|
||||||
|
Continue
|
||||||
|
</Button>
|
||||||
|
</div>
|
||||||
|
);
|
||||||
|
}
|
||||||
145
src/components/main/UnlockIdentityModal.tsx
Normal file
145
src/components/main/UnlockIdentityModal.tsx
Normal file
|
|
@ -0,0 +1,145 @@
|
||||||
|
"use client";
|
||||||
|
|
||||||
|
import { authClient } from "@/lib/auth-client";
|
||||||
|
import { getDb } from "@/lib/dexie";
|
||||||
|
import { restoreSessionKey, unlockSessionKey } from "@/lib/identity/sessionKey";
|
||||||
|
import { useIdentityLock } from "@/lib/identity/useIdentityLock";
|
||||||
|
import { Eye, EyeOff, KeyRound, Loader2 } from "lucide-react";
|
||||||
|
import { useEffect, useRef, useState } from "react";
|
||||||
|
import { toast } from "sonner";
|
||||||
|
import { Button } from "../ui/button";
|
||||||
|
import { Dialog, DialogContent, DialogHeader, DialogTitle } from "../ui/dialog";
|
||||||
|
import { Input } from "../ui/input";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Global unlock gate shown whenever the user is authenticated, has a local
|
||||||
|
* identity, but the in-memory session key store is cold (fresh page load,
|
||||||
|
* navigation from another tab, etc.).
|
||||||
|
*
|
||||||
|
* Stays hidden for unauthenticated users and for users who have not yet
|
||||||
|
* created an identity (those see <CreateIdentity> instead).
|
||||||
|
*/
|
||||||
|
export default function UnlockIdentityModal() {
|
||||||
|
const { data: session, isPending: sessionLoading } = authClient.useSession();
|
||||||
|
const isUnlocked = useIdentityLock();
|
||||||
|
|
||||||
|
const [hasLocalIdentity, setHasLocalIdentity] = useState<boolean | null>(null);
|
||||||
|
const [password, setPassword] = useState("");
|
||||||
|
const [showPassword, setShowPassword] = useState(false);
|
||||||
|
const [loading, setLoading] = useState(false);
|
||||||
|
const [error, setError] = useState<string | null>(null);
|
||||||
|
const inputRef = useRef<HTMLInputElement>(null);
|
||||||
|
|
||||||
|
// On session available: first try a silent restore from sessionStorage so
|
||||||
|
// that a page reload doesn't force a password re-entry. Only if that fails
|
||||||
|
// do we confirm a local Dexie record exists and show the prompt.
|
||||||
|
useEffect(() => {
|
||||||
|
if (!session?.user.id) {
|
||||||
|
setHasLocalIdentity(null);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// Attempt silent restore; if it works, `useIdentityLock` flips to true
|
||||||
|
// and `shouldShow` stays false — no prompt needed.
|
||||||
|
if (restoreSessionKey(session.user.id)) return;
|
||||||
|
|
||||||
|
getDb().identity.get(session.user.id).then((record) => {
|
||||||
|
setHasLocalIdentity(record !== undefined);
|
||||||
|
});
|
||||||
|
}, [session?.user.id]);
|
||||||
|
|
||||||
|
// Focus the password input when the modal becomes visible.
|
||||||
|
useEffect(() => {
|
||||||
|
if (!isUnlocked && hasLocalIdentity) {
|
||||||
|
setTimeout(() => inputRef.current?.focus(), 50);
|
||||||
|
}
|
||||||
|
}, [isUnlocked, hasLocalIdentity]);
|
||||||
|
|
||||||
|
const shouldShow =
|
||||||
|
!sessionLoading &&
|
||||||
|
!!session &&
|
||||||
|
hasLocalIdentity === true &&
|
||||||
|
!isUnlocked;
|
||||||
|
|
||||||
|
async function handleUnlock(e: React.FormEvent) {
|
||||||
|
e.preventDefault();
|
||||||
|
if (!session?.user.id || !password) return;
|
||||||
|
|
||||||
|
setLoading(true);
|
||||||
|
setError(null);
|
||||||
|
try {
|
||||||
|
await unlockSessionKey(session.user.id, password);
|
||||||
|
setPassword("");
|
||||||
|
toast.success("Identity unlocked.");
|
||||||
|
} catch {
|
||||||
|
setError("Wrong password. Please try again.");
|
||||||
|
} finally {
|
||||||
|
setLoading(false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return (
|
||||||
|
<Dialog open={shouldShow}>
|
||||||
|
<DialogContent
|
||||||
|
onInteractOutside={(e) => e.preventDefault()}
|
||||||
|
className="sm:max-w-sm border-border bg-card p-0 overflow-hidden [&>button]:hidden"
|
||||||
|
>
|
||||||
|
<div className="px-6 pt-6 pb-2 border-b border-border/60">
|
||||||
|
<div className="flex items-center gap-3 mb-3">
|
||||||
|
<div className="flex items-center justify-center w-8 h-8 rounded bg-primary/10 border border-primary/20">
|
||||||
|
<KeyRound className="w-4 h-4 text-primary" />
|
||||||
|
</div>
|
||||||
|
<span className="font-mono text-[10px] text-muted-foreground tracking-[0.25em] uppercase">
|
||||||
|
Identity locked
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
<DialogHeader className="text-left space-y-1">
|
||||||
|
<DialogTitle className="font-display text-2xl tracking-[0.06em] text-foreground">
|
||||||
|
Unlock your identity
|
||||||
|
</DialogTitle>
|
||||||
|
<p className="text-sm text-muted-foreground leading-relaxed">
|
||||||
|
Enter your master password to enable signing for this session.
|
||||||
|
</p>
|
||||||
|
</DialogHeader>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<form onSubmit={handleUnlock} className="px-6 py-5 space-y-4">
|
||||||
|
<div className="space-y-1.5">
|
||||||
|
<label className="font-mono text-[11px] tracking-[0.15em] uppercase text-muted-foreground">
|
||||||
|
Master Password
|
||||||
|
</label>
|
||||||
|
<div className="relative">
|
||||||
|
<Input
|
||||||
|
ref={inputRef}
|
||||||
|
type={showPassword ? "text" : "password"}
|
||||||
|
value={password}
|
||||||
|
onChange={(e) => { setPassword(e.target.value); setError(null); }}
|
||||||
|
className="h-11 text-base bg-background border-border/60 pr-10 focus-visible:ring-primary/50 focus-visible:border-primary/50"
|
||||||
|
placeholder="••••••••••••"
|
||||||
|
disabled={loading}
|
||||||
|
/>
|
||||||
|
<button
|
||||||
|
type="button"
|
||||||
|
onClick={() => setShowPassword((v) => !v)}
|
||||||
|
className="absolute right-3 top-1/2 -translate-y-1/2 text-muted-foreground hover:text-foreground transition-colors"
|
||||||
|
tabIndex={-1}
|
||||||
|
>
|
||||||
|
{showPassword ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
{error && (
|
||||||
|
<p className="font-mono text-[10px] tracking-wide text-destructive">{error}</p>
|
||||||
|
)}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<Button
|
||||||
|
type="submit"
|
||||||
|
className="w-full h-11 font-mono text-[11px] tracking-[0.2em] uppercase"
|
||||||
|
disabled={loading || !password}
|
||||||
|
>
|
||||||
|
{loading ? <Loader2 className="w-4 h-4 animate-spin" /> : "Unlock"}
|
||||||
|
</Button>
|
||||||
|
</form>
|
||||||
|
</DialogContent>
|
||||||
|
</Dialog>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
@ -1,66 +1,67 @@
|
||||||
"use client"
|
"use client"
|
||||||
|
|
||||||
import * as React from "react"
|
|
||||||
import { ChevronDownIcon } from "lucide-react"
|
import { ChevronDownIcon } from "lucide-react"
|
||||||
import { Accordion as AccordionPrimitive } from "radix-ui"
|
import { Accordion as AccordionPrimitive } from "radix-ui"
|
||||||
|
import * as React from "react"
|
||||||
|
|
||||||
import { cn } from "@/lib/utils"
|
import { cn } from "@/lib/utils"
|
||||||
|
|
||||||
function Accordion({
|
function Accordion({
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof AccordionPrimitive.Root>) {
|
}: React.ComponentProps<typeof AccordionPrimitive.Root>) {
|
||||||
return <AccordionPrimitive.Root data-slot="accordion" {...props} />
|
return <AccordionPrimitive.Root data-slot="accordion" {...props} />
|
||||||
}
|
}
|
||||||
|
|
||||||
function AccordionItem({
|
function AccordionItem({
|
||||||
className,
|
className,
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof AccordionPrimitive.Item>) {
|
}: React.ComponentProps<typeof AccordionPrimitive.Item>) {
|
||||||
return (
|
return (
|
||||||
<AccordionPrimitive.Item
|
<AccordionPrimitive.Item
|
||||||
data-slot="accordion-item"
|
data-slot="accordion-item"
|
||||||
className={cn("border-b last:border-b-0", className)}
|
className={cn("border-b last:border-b-0", className)}
|
||||||
{...props}
|
{...props}
|
||||||
/>
|
/>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
function AccordionTrigger({
|
function AccordionTrigger({
|
||||||
className,
|
className,
|
||||||
children,
|
children,
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof AccordionPrimitive.Trigger>) {
|
}: React.ComponentProps<typeof AccordionPrimitive.Trigger>) {
|
||||||
return (
|
return (
|
||||||
<AccordionPrimitive.Header className="flex">
|
<AccordionPrimitive.Header className="flex">
|
||||||
<AccordionPrimitive.Trigger
|
<AccordionPrimitive.Trigger
|
||||||
data-slot="accordion-trigger"
|
data-slot="accordion-trigger"
|
||||||
className={cn(
|
className={cn(
|
||||||
"flex flex-1 items-start justify-between gap-4 rounded-md py-4 text-left text-sm font-medium transition-all outline-none hover:underline focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 [&[data-state=open]>svg]:rotate-180",
|
"flex flex-1 items-start justify-between gap-4 rounded-md py-4 text-left text-sm font-medium transition-all outline-none hover:underline focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 [&[data-state=open]>svg]:rotate-180",
|
||||||
className
|
className
|
||||||
)}
|
)}
|
||||||
{...props}
|
{...props}
|
||||||
>
|
>
|
||||||
{children}
|
{children}
|
||||||
<ChevronDownIcon className="pointer-events-none size-4 shrink-0 translate-y-0.5 text-muted-foreground transition-transform duration-200" />
|
<ChevronDownIcon className="pointer-events-none size-4 shrink-0 translate-y-0.5 text-muted-foreground transition-transform duration-200" />
|
||||||
</AccordionPrimitive.Trigger>
|
</AccordionPrimitive.Trigger>
|
||||||
</AccordionPrimitive.Header>
|
</AccordionPrimitive.Header>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
function AccordionContent({
|
function AccordionContent({
|
||||||
className,
|
className,
|
||||||
children,
|
children,
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof AccordionPrimitive.Content>) {
|
}: React.ComponentProps<typeof AccordionPrimitive.Content>) {
|
||||||
return (
|
return (
|
||||||
<AccordionPrimitive.Content
|
<AccordionPrimitive.Content
|
||||||
data-slot="accordion-content"
|
data-slot="accordion-content"
|
||||||
className="overflow-hidden text-sm data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
|
className="overflow-hidden text-sm data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
|
||||||
{...props}
|
{...props}
|
||||||
>
|
>
|
||||||
<div className={cn("pt-0 pb-4", className)}>{children}</div>
|
<div className={cn("pt-0 pb-4", className)}>{children}</div>
|
||||||
</AccordionPrimitive.Content>
|
</AccordionPrimitive.Content>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
export { Accordion, AccordionItem, AccordionTrigger, AccordionContent }
|
export { Accordion, AccordionContent, AccordionItem, AccordionTrigger }
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -61,4 +61,4 @@ function Button({
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
export { Button, buttonVariants }
|
export { Button }
|
||||||
|
|
|
||||||
|
|
@ -82,6 +82,6 @@ function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
|
||||||
}
|
}
|
||||||
|
|
||||||
export {
|
export {
|
||||||
Card, CardAction, CardContent, CardDescription, CardFooter, CardHeader, CardTitle
|
Card, CardContent, CardHeader, CardTitle
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -146,14 +146,10 @@ function DialogDescription({
|
||||||
|
|
||||||
export {
|
export {
|
||||||
Dialog,
|
Dialog,
|
||||||
DialogClose,
|
|
||||||
DialogContent,
|
DialogContent,
|
||||||
DialogDescription,
|
DialogDescription,
|
||||||
DialogFooter,
|
DialogFooter,
|
||||||
DialogHeader,
|
DialogHeader,
|
||||||
DialogOverlay,
|
|
||||||
DialogPortal,
|
|
||||||
DialogTitle,
|
DialogTitle,
|
||||||
DialogTrigger
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -239,11 +239,9 @@ function DropdownMenuSubContent({
|
||||||
}
|
}
|
||||||
|
|
||||||
export {
|
export {
|
||||||
DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent,
|
DropdownMenu, DropdownMenuContent,
|
||||||
DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup,
|
DropdownMenuItem, DropdownMenuLabel,
|
||||||
DropdownMenuRadioItem,
|
|
||||||
DropdownMenuSeparator,
|
DropdownMenuSeparator,
|
||||||
DropdownMenuShortcut,
|
|
||||||
DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger
|
DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -157,7 +157,7 @@ function FormMessage({ className, ...props }: React.ComponentProps<"p">) {
|
||||||
|
|
||||||
export {
|
export {
|
||||||
Form, FormControl,
|
Form, FormControl,
|
||||||
FormDescription, FormField, FormItem,
|
FormField, FormItem,
|
||||||
FormLabel, FormMessage, useFormField
|
FormLabel, FormMessage,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,35 +1,35 @@
|
||||||
"use client"
|
"use client"
|
||||||
|
|
||||||
import * as React from "react"
|
|
||||||
import { Switch as SwitchPrimitive } from "radix-ui"
|
import { Switch as SwitchPrimitive } from "radix-ui"
|
||||||
|
import * as React from "react"
|
||||||
|
|
||||||
import { cn } from "@/lib/utils"
|
import { cn } from "@/lib/utils"
|
||||||
|
|
||||||
function Switch({
|
function Switch({
|
||||||
className,
|
className,
|
||||||
size = "default",
|
size = "default",
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof SwitchPrimitive.Root> & {
|
}: React.ComponentProps<typeof SwitchPrimitive.Root> & {
|
||||||
size?: "sm" | "default"
|
size?: "sm" | "default"
|
||||||
}) {
|
}) {
|
||||||
return (
|
return (
|
||||||
<SwitchPrimitive.Root
|
<SwitchPrimitive.Root
|
||||||
data-slot="switch"
|
data-slot="switch"
|
||||||
data-size={size}
|
data-size={size}
|
||||||
className={cn(
|
className={cn(
|
||||||
"peer group/switch inline-flex shrink-0 items-center rounded-full border border-transparent shadow-xs transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 data-[size=default]:h-[1.15rem] data-[size=default]:w-8 data-[size=sm]:h-3.5 data-[size=sm]:w-6 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input dark:data-[state=unchecked]:bg-input/80",
|
"peer group/switch inline-flex shrink-0 items-center rounded-full border border-transparent shadow-xs transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 data-[size=default]:h-[1.15rem] data-[size=default]:w-8 data-[size=sm]:h-3.5 data-[size=sm]:w-6 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input dark:data-[state=unchecked]:bg-input/80",
|
||||||
className
|
className
|
||||||
)}
|
)}
|
||||||
{...props}
|
{...props}
|
||||||
>
|
>
|
||||||
<SwitchPrimitive.Thumb
|
<SwitchPrimitive.Thumb
|
||||||
data-slot="switch-thumb"
|
data-slot="switch-thumb"
|
||||||
className={cn(
|
className={cn(
|
||||||
"pointer-events-none block rounded-full bg-background ring-0 transition-transform group-data-[size=default]/switch:size-4 group-data-[size=sm]/switch:size-3 data-[state=checked]:translate-x-[calc(100%-2px)] data-[state=unchecked]:translate-x-0 dark:data-[state=checked]:bg-primary-foreground dark:data-[state=unchecked]:bg-foreground"
|
"pointer-events-none block rounded-full bg-background ring-0 transition-transform group-data-[size=default]/switch:size-4 group-data-[size=sm]/switch:size-3 data-[state=checked]:translate-x-[calc(100%-2px)] data-[state=unchecked]:translate-x-0 dark:data-[state=checked]:bg-primary-foreground dark:data-[state=unchecked]:bg-foreground"
|
||||||
)}
|
)}
|
||||||
/>
|
/>
|
||||||
</SwitchPrimitive.Root>
|
</SwitchPrimitive.Root>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
export { Switch }
|
export { Switch }
|
||||||
|
|
|
||||||
|
|
@ -1,57 +1,58 @@
|
||||||
"use client"
|
"use client"
|
||||||
|
|
||||||
import * as React from "react"
|
|
||||||
import { Tooltip as TooltipPrimitive } from "radix-ui"
|
import { Tooltip as TooltipPrimitive } from "radix-ui"
|
||||||
|
import * as React from "react"
|
||||||
|
|
||||||
import { cn } from "@/lib/utils"
|
import { cn } from "@/lib/utils"
|
||||||
|
|
||||||
function TooltipProvider({
|
function TooltipProvider({
|
||||||
delayDuration = 0,
|
delayDuration = 0,
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof TooltipPrimitive.Provider>) {
|
}: React.ComponentProps<typeof TooltipPrimitive.Provider>) {
|
||||||
return (
|
return (
|
||||||
<TooltipPrimitive.Provider
|
<TooltipPrimitive.Provider
|
||||||
data-slot="tooltip-provider"
|
data-slot="tooltip-provider"
|
||||||
delayDuration={delayDuration}
|
delayDuration={delayDuration}
|
||||||
{...props}
|
{...props}
|
||||||
/>
|
/>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
function Tooltip({
|
function Tooltip({
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof TooltipPrimitive.Root>) {
|
}: React.ComponentProps<typeof TooltipPrimitive.Root>) {
|
||||||
return <TooltipPrimitive.Root data-slot="tooltip" {...props} />
|
return <TooltipPrimitive.Root data-slot="tooltip" {...props} />
|
||||||
}
|
}
|
||||||
|
|
||||||
function TooltipTrigger({
|
function TooltipTrigger({
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof TooltipPrimitive.Trigger>) {
|
}: React.ComponentProps<typeof TooltipPrimitive.Trigger>) {
|
||||||
return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />
|
return <TooltipPrimitive.Trigger data-slot="tooltip-trigger" {...props} />
|
||||||
}
|
}
|
||||||
|
|
||||||
function TooltipContent({
|
function TooltipContent({
|
||||||
className,
|
className,
|
||||||
sideOffset = 0,
|
sideOffset = 0,
|
||||||
children,
|
children,
|
||||||
...props
|
...props
|
||||||
}: React.ComponentProps<typeof TooltipPrimitive.Content>) {
|
}: React.ComponentProps<typeof TooltipPrimitive.Content>) {
|
||||||
return (
|
return (
|
||||||
<TooltipPrimitive.Portal>
|
<TooltipPrimitive.Portal>
|
||||||
<TooltipPrimitive.Content
|
<TooltipPrimitive.Content
|
||||||
data-slot="tooltip-content"
|
data-slot="tooltip-content"
|
||||||
sideOffset={sideOffset}
|
sideOffset={sideOffset}
|
||||||
className={cn(
|
className={cn(
|
||||||
"z-50 w-fit origin-(--radix-tooltip-content-transform-origin) animate-in rounded-md bg-foreground px-3 py-1.5 text-xs text-balance text-background fade-in-0 zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95",
|
"z-50 w-fit origin-(--radix-tooltip-content-transform-origin) animate-in rounded-md bg-foreground px-3 py-1.5 text-xs text-balance text-background fade-in-0 zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95",
|
||||||
className
|
className
|
||||||
)}
|
)}
|
||||||
{...props}
|
{...props}
|
||||||
>
|
>
|
||||||
{children}
|
{children}
|
||||||
<TooltipPrimitive.Arrow className="z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px] bg-foreground fill-foreground" />
|
<TooltipPrimitive.Arrow className="z-50 size-2.5 translate-y-[calc(-50%_-_2px)] rotate-45 rounded-[2px] bg-foreground fill-foreground" />
|
||||||
</TooltipPrimitive.Content>
|
</TooltipPrimitive.Content>
|
||||||
</TooltipPrimitive.Portal>
|
</TooltipPrimitive.Portal>
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }
|
export { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger }
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -10,7 +10,12 @@ import EmailService from "./mail";
|
||||||
import minioClient from "./plugins/storage/server/minio.client";
|
import minioClient from "./plugins/storage/server/minio.client";
|
||||||
import getRedisClient from "./redis";
|
import getRedisClient from "./redis";
|
||||||
|
|
||||||
const isTest = process.env.NODE_ENV === "test";
|
// `process.env.NODE_ENV` is statically replaced by Next.js at compile time, so
|
||||||
|
// it cannot be used to detect the federation test cluster (which is built in
|
||||||
|
// dev mode but should behave like a test environment). `SIPHER_TEST_MODE` is a
|
||||||
|
// project-owned escape hatch the docker compose env files set explicitly.
|
||||||
|
const isTest =
|
||||||
|
process.env.SIPHER_TEST_MODE === "true" || process.env.NODE_ENV === "test";
|
||||||
const emailService: EmailService | undefined = isTest ? undefined : new EmailService();
|
const emailService: EmailService | undefined = isTest ? undefined : new EmailService();
|
||||||
|
|
||||||
const federationKeysExist =
|
const federationKeysExist =
|
||||||
|
|
@ -28,7 +33,7 @@ if (!federationKeysExist) {
|
||||||
|
|
||||||
const bAuth = betterAuth({
|
const bAuth = betterAuth({
|
||||||
secret: process.env.BETTER_AUTH_SECRET!,
|
secret: process.env.BETTER_AUTH_SECRET!,
|
||||||
baseURL: process.env.BETTER_AUTH_URL ?? (process.env.NODE_ENV === "test" ? "http://localhost:3000" : undefined),
|
baseURL: process.env.BETTER_AUTH_URL ?? (isTest ? "http://localhost:3000" : undefined),
|
||||||
experimental: {
|
experimental: {
|
||||||
joins: true
|
joins: true
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -28,12 +28,12 @@ interface FederationDeliveryJob {
|
||||||
|
|
||||||
Defines the data contract for a federation delivery job.
|
Defines the data contract for a federation delivery job.
|
||||||
|
|
||||||
| Field | Type | Description |
|
| Field | Type | Description |
|
||||||
| -------------- | -------- | --------------------------------------------------------------------------- |
|
| --------------- | -------- | ----------------------------------------------------------------------------- |
|
||||||
| `deliveryJobId`| `string` | Primary key of the corresponding row in the `deliveryJobs` database table. |
|
| `deliveryJobId` | `string` | Primary key of the corresponding row in the `deliveryJobs` database table. |
|
||||||
| `targetUrl` | `string` | Full URL of the remote server's federation inbox endpoint. |
|
| `targetUrl` | `string` | Full URL of the remote server's federation inbox endpoint. |
|
||||||
| `serverUrl` | `string` | Origin URL of the target server (used for registry lookups and blacklisting).|
|
| `serverUrl` | `string` | Origin URL of the target server (used for registry lookups and blacklisting). |
|
||||||
| `payload` | `string` | Serialized JSON string containing the activity method and associated data. |
|
| `payload` | `string` | Serialized JSON string containing the activity method and associated data. |
|
||||||
|
|
||||||
### `HealthCheckJob`
|
### `HealthCheckJob`
|
||||||
|
|
||||||
|
|
@ -45,9 +45,9 @@ interface HealthCheckJob {
|
||||||
|
|
||||||
Defines the data contract for a health-check job.
|
Defines the data contract for a health-check job.
|
||||||
|
|
||||||
| Field | Type | Description |
|
| Field | Type | Description |
|
||||||
| ----------- | -------- | ------------------------------------------- |
|
| ----------- | -------- | ------------------------------------------ |
|
||||||
| `serverUrl` | `string` | The remote server URL to probe for health. |
|
| `serverUrl` | `string` | The remote server URL to probe for health. |
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
@ -107,12 +107,12 @@ Returns a singleton `Queue<FederationDeliveryJob>` instance backed by the `feder
|
||||||
|
|
||||||
**Default job options:**
|
**Default job options:**
|
||||||
|
|
||||||
| Option | Value | Rationale |
|
| Option | Value | Rationale |
|
||||||
| ----------------- | ---------------- | ------------------------------------------------------------ |
|
| ------------------ | ----------------- | ---------------------------------------------------- |
|
||||||
| `attempts` | `5` | Up to 5 retries before the job is marked as failed. |
|
| `attempts` | `5` | Up to 5 retries before the job is marked as failed. |
|
||||||
| `backoff` | exponential, 5s | Delay doubles on each retry: 5s, 10s, 20s, 40s. |
|
| `backoff` | exponential, 5s | Delay doubles on each retry: 5s, 10s, 20s, 40s. |
|
||||||
| `removeOnComplete`| `{ age: 86400 }` | Completed jobs are pruned after 24 hours. |
|
| `removeOnComplete` | `{ age: 86400 }` | Completed jobs are pruned after 24 hours. |
|
||||||
| `removeOnFail` | `{ age: 604800 }` | Failed jobs are retained for 7 days for diagnostics. |
|
| `removeOnFail` | `{ age: 604800 }` | Failed jobs are retained for 7 days for diagnostics. |
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
@ -136,10 +136,10 @@ Schedules a delayed health-check job for a remote server.
|
||||||
|
|
||||||
**Parameters:**
|
**Parameters:**
|
||||||
|
|
||||||
| Parameter | Type | Description |
|
| Parameter | Type | Description |
|
||||||
| ----------- | -------- | --------------------------------------------------------------------- |
|
| ----------- | -------- | ----------------------------------------------------------------- |
|
||||||
| `serverUrl` | `string` | The remote server URL to check. |
|
| `serverUrl` | `string` | The remote server URL to check. |
|
||||||
| `attempt` | `number` | Zero-based attempt counter; used to compute the delay and job ID. |
|
| `attempt` | `number` | Zero-based attempt counter; used to compute the delay and job ID. |
|
||||||
|
|
||||||
**Internal logic:**
|
**Internal logic:**
|
||||||
|
|
||||||
|
|
@ -163,27 +163,27 @@ Workers use a dedicated Redis connection via `getRedisWorkerConnection()`, separ
|
||||||
|
|
||||||
**Delivery worker configuration:**
|
**Delivery worker configuration:**
|
||||||
|
|
||||||
| Option | Value |
|
| Option | Value |
|
||||||
| ------------- | ------- |
|
| ------------- | ----- |
|
||||||
| `concurrency` | `10` |
|
| `concurrency` | `10` |
|
||||||
|
|
||||||
**Health-check worker configuration:**
|
**Health-check worker configuration:**
|
||||||
|
|
||||||
| Option | Value |
|
| Option | Value |
|
||||||
| ------------- | ------- |
|
| ------------- | ----- |
|
||||||
| `concurrency` | `3` |
|
| `concurrency` | `3` |
|
||||||
|
|
||||||
**Lifecycle events:**
|
**Lifecycle events:**
|
||||||
|
|
||||||
| Worker | Event | Behavior |
|
| Worker | Event | Behavior |
|
||||||
| -------------- | ----------- | --------------------------------------------------------------------------- |
|
| ------------ | ----------- | --------------------------------------------------------------------------------- |
|
||||||
| Delivery | `ready` | Logs a confirmation that the worker is connected to Redis. |
|
| Delivery | `ready` | Logs a confirmation that the worker is connected to Redis. |
|
||||||
| Delivery | `failed` | Logs the job ID, method, target URL, attempt count, remaining retries, and error. |
|
| Delivery | `failed` | Logs the job ID, method, target URL, attempt count, remaining retries, and error. |
|
||||||
| Delivery | `completed` | Deletes the corresponding `deliveryJobs` database row. |
|
| Delivery | `completed` | Deletes the corresponding `deliveryJobs` database row. |
|
||||||
| Delivery | `error` | Logs a generic worker-level error to the console. |
|
| Delivery | `error` | Logs a generic worker-level error to the console. |
|
||||||
| Health-check | `ready` | Logs a confirmation that the worker is connected to Redis. |
|
| Health-check | `ready` | Logs a confirmation that the worker is connected to Redis. |
|
||||||
| Health-check | `failed` | Logs the job ID and error message. |
|
| Health-check | `failed` | Logs the job ID and error message. |
|
||||||
| Health-check | `error` | Logs a generic worker-level error to the console. |
|
| Health-check | `error` | Logs a generic worker-level error to the console. |
|
||||||
|
|
||||||
**Returns:** `{ deliveryWorker, healthCheckWorker }`
|
**Returns:** `{ deliveryWorker, healthCheckWorker }`
|
||||||
|
|
||||||
|
|
@ -251,13 +251,13 @@ Processes the acknowledgment (`PROXY_RESPONSE`) for a `deliver-follow` job.
|
||||||
|
|
||||||
**Parameters:**
|
**Parameters:**
|
||||||
|
|
||||||
| Parameter | Type | Description |
|
| Parameter | Type | Description |
|
||||||
| -----------------------| ----------------------- | ------------------------------------------------ |
|
| ----------------------- | --------------------- | ------------------------------------------------------------------------------------- |
|
||||||
| `ackPayload` | `AckPayload` | The acknowledgment payload containing signature and decrypted data. |
|
| `ackPayload` | `AckPayload` | The acknowledgment payload containing signature and decrypted data. |
|
||||||
| `serverUrl` | `string` | Origin URL of the remote server. |
|
| `serverUrl` | `string` | Origin URL of the remote server. |
|
||||||
| `cachedServerPublicKey`| `string \| undefined` | The server's signing public key, if already known from the registry at delivery time. |
|
| `cachedServerPublicKey` | `string \| undefined` | The server's signing public key, if already known from the registry at delivery time. |
|
||||||
| `deliveryJobId` | `string` | ID of the delivery job record for cleanup. |
|
| `deliveryJobId` | `string` | ID of the delivery job record for cleanup. |
|
||||||
| `jobId` | `string \| undefined` | BullMQ job ID for diagnostic logging. |
|
| `jobId` | `string \| undefined` | BullMQ job ID for diagnostic logging. |
|
||||||
|
|
||||||
**Internal logic:**
|
**Internal logic:**
|
||||||
|
|
||||||
|
|
@ -317,36 +317,36 @@ await scheduleHealthCheck('https://remote.example.com', 0);
|
||||||
|
|
||||||
Jobs that throw `UnrecoverableError` are immediately marked as failed and **will not be retried**, even if the queue's `attempts` option is greater than 1.
|
Jobs that throw `UnrecoverableError` are immediately marked as failed and **will not be retried**, even if the queue's `attempts` option is greater than 1.
|
||||||
|
|
||||||
| Scenario | Thrown From | Description |
|
| Scenario | Thrown From | Description |
|
||||||
| --------------------------------- | ------------------------------ | ------------------------------------------------------- |
|
| ------------------------------ | --------------------------- | -------------------------------------------------------------------------- |
|
||||||
| Malformed payload JSON | `processFederationDelivery` | The job payload cannot be parsed as valid JSON. |
|
| Malformed payload JSON | `processFederationDelivery` | The job payload cannot be parsed as valid JSON. |
|
||||||
| Missing or non-string method | `processFederationDelivery` | The `method` field is missing, not a string, or not in the allowed set.|
|
| Missing or non-string method | `processFederationDelivery` | The `method` field is missing, not a string, or not in the allowed set. |
|
||||||
| Blacklisted target server | `processFederationDelivery` | The target server is in the `blacklistedServers` table. |
|
| Blacklisted target server | `processFederationDelivery` | The target server is in the `blacklistedServers` table. |
|
||||||
| Missing `BETTER_AUTH_URL` | `processFederationDelivery` | The environment variable is not set; federation requests cannot be sent. |
|
| Missing `BETTER_AUTH_URL` | `processFederationDelivery` | The environment variable is not set; federation requests cannot be sent. |
|
||||||
| Non-JSON response from remote | `processFederationDelivery` | The remote returned a 200 OK with a non-JSON body. |
|
| Non-JSON response from remote | `processFederationDelivery` | The remote returned a 200 OK with a non-JSON body. |
|
||||||
| Missing acknowledgment | `processFederationDelivery` | The remote response does not contain a `PROXY_RESPONSE` payload.|
|
| Missing acknowledgment | `processFederationDelivery` | The remote response does not contain a `PROXY_RESPONSE` payload. |
|
||||||
| Invalid follow ack payload | `handleFollowAck` | The decrypted payload fails `FollowEnvelopeSchema` validation. |
|
| Invalid follow ack payload | `handleFollowAck` | The decrypted payload fails `FollowEnvelopeSchema` validation. |
|
||||||
| Missing signing public key | `handleFollowAck` | The server has no `publicKey` in the registry to verify the ack signature. |
|
| Missing signing public key | `handleFollowAck` | The server has no `publicKey` in the registry to verify the ack signature. |
|
||||||
| Signature verification failure | `handleFollowAck` | The cryptographic signature on the ack does not match. |
|
| Signature verification failure | `handleFollowAck` | The cryptographic signature on the ack does not match. |
|
||||||
|
|
||||||
### Retryable Errors
|
### Retryable Errors
|
||||||
|
|
||||||
Jobs that throw a regular `Error` are returned to the queue and retried according to the queue's backoff configuration.
|
Jobs that throw a regular `Error` are returned to the queue and retried according to the queue's backoff configuration.
|
||||||
|
|
||||||
| Scenario | Thrown From | Description |
|
| Scenario | Thrown From | Description |
|
||||||
| --------------------------------- | ------------------------------ | ------------------------------------------------------- |
|
| ---------------------- | --------------------------- | ------------------------------------------------------------------------------------------ |
|
||||||
| Auto-discovery failure | `processFederationDelivery` | The server is not in the registry and `discoverAndRegister` throws a non-`DiscoveryError`. |
|
| Auto-discovery failure | `processFederationDelivery` | The server is not in the registry and `discoverAndRegister` throws a non-`DiscoveryError`. |
|
||||||
| HTTP delivery failure | `processFederationDelivery` | The remote endpoint returns a non-OK HTTP status code. |
|
| HTTP delivery failure | `processFederationDelivery` | The remote endpoint returns a non-OK HTTP status code. |
|
||||||
| Network / fetch error | `processFederationDelivery` | `federationFetch` throws due to timeout, DNS failure, etc. |
|
| Network / fetch error | `processFederationDelivery` | `federationFetch` throws due to timeout, DNS failure, etc. |
|
||||||
|
|
||||||
### Silent Skips (No Error)
|
### Silent Skips (No Error)
|
||||||
|
|
||||||
| Scenario | Location | Description |
|
| Scenario | Location | Description |
|
||||||
| --------------------------------- | ----------------------------- | ------------------------------------------------------- |
|
| ------------------------------ | -------------------- | -------------------------------------------------------------------------- |
|
||||||
| Unhealthy reason not checkable | `processHealthCheck` | The server's threat policy forbids direct health checks.|
|
| Unhealthy reason not checkable | `processHealthCheck` | The server's threat policy forbids direct health checks. |
|
||||||
| Server already healthy | `processHealthCheck` | The server is already marked healthy in the registry. |
|
| Server already healthy | `processHealthCheck` | The server is already marked healthy in the registry. |
|
||||||
| Server not in registry | `processHealthCheck` | The server was removed or never registered. |
|
| Server not in registry | `processHealthCheck` | The server was removed or never registered. |
|
||||||
| Unknown follow ack | `handleFollowAck` | The local `follows` table has no matching row for the acknowledged follow. |
|
| Unknown follow ack | `handleFollowAck` | The local `follows` table has no matching row for the acknowledged follow. |
|
||||||
|
|
||||||
### Worker-Level Errors
|
### Worker-Level Errors
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,3 @@
|
||||||
export { getFederationQueue, getHealthCheckQueue, scheduleHealthCheck } from './queues';
|
export { getFederationQueue, getHealthCheckQueue, scheduleHealthCheck } from './queues';
|
||||||
export type { FederationDeliveryJob, HealthCheckJob } from './queues';
|
export type { FederationDeliveryJob } from './queues';
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -159,19 +159,20 @@ export async function processFederationDelivery(job: Job<FederationDeliveryJob>)
|
||||||
|
|
||||||
debug('delivery to %s acknowledged (body length: %d)', targetUrl, JSON.stringify(responseBody).length);
|
debug('delivery to %s acknowledged (body length: %d)', targetUrl, JSON.stringify(responseBody).length);
|
||||||
|
|
||||||
const ackPayload: AckPayload | null =
|
// The ack envelope can arrive in two shapes:
|
||||||
responseBody && typeof responseBody === 'object' && 'payload' in (responseBody as Record<string, unknown>) && (responseBody as Record<string, unknown>).payload !== null
|
// • Proxy-wrapped (delivered through /proxy):
|
||||||
? ((responseBody as Record<string, unknown>).payload as AckPayload | null)
|
// { payload: { method: 'PROXY_RESPONSE', data, signature }, ... }
|
||||||
: null;
|
// • Direct (delivered straight to the target endpoint, e.g. /api/auth/...):
|
||||||
|
// { method: 'PROXY_RESPONSE', data, signature, status: 'acknowledged' }
|
||||||
|
// Accept either — proxy routing is an optimisation, not part of the ack contract.
|
||||||
|
const body = (responseBody ?? {}) as Record<string, unknown>;
|
||||||
|
const wrappedPayload =
|
||||||
|
body.payload !== null && body.payload !== undefined ? (body.payload as AckPayload) : null;
|
||||||
|
const inlinePayload =
|
||||||
|
body.method === 'PROXY_RESPONSE' ? (body as unknown as AckPayload) : null;
|
||||||
|
const ackPayload: AckPayload | null = wrappedPayload ?? inlinePayload;
|
||||||
|
|
||||||
if (!ackPayload) {
|
if (!ackPayload || ackPayload.method !== 'PROXY_RESPONSE') {
|
||||||
debug('delivery to %s not acknowledged', targetUrl);
|
|
||||||
throw new UnrecoverableError(
|
|
||||||
`Federation delivery to ${targetUrl} not acknowledged`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (ackPayload.method !== 'PROXY_RESPONSE') {
|
|
||||||
debug('delivery to %s not acknowledged', targetUrl);
|
debug('delivery to %s not acknowledged', targetUrl);
|
||||||
throw new UnrecoverableError(
|
throw new UnrecoverableError(
|
||||||
`Federation delivery to ${targetUrl} not acknowledged`,
|
`Federation delivery to ${targetUrl} not acknowledged`,
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
import { createHash } from 'node:crypto';
|
|
||||||
import { Queue } from 'bullmq';
|
import { Queue } from 'bullmq';
|
||||||
import createDebug from 'debug';
|
import createDebug from 'debug';
|
||||||
|
import { createHash } from 'node:crypto';
|
||||||
import { getRedisConnection } from './connection';
|
import { getRedisConnection } from './connection';
|
||||||
|
|
||||||
const debug = createDebug('app:federation:worker');
|
const debug = createDebug('app:federation:worker');
|
||||||
|
|
|
||||||
|
|
@ -109,6 +109,8 @@ export const follows = pgTable(
|
||||||
{ onDelete: "cascade" },
|
{ onDelete: "cascade" },
|
||||||
),
|
),
|
||||||
acknowledged: boolean("acknowledged").default(false).notNull(),
|
acknowledged: boolean("acknowledged").default(false).notNull(),
|
||||||
|
requesterSignature: text("requester_signature"),
|
||||||
|
responderSignature: text("responder_signature"),
|
||||||
},
|
},
|
||||||
(table) => [
|
(table) => [
|
||||||
index("follows_followerServerUrl_idx").on(table.followerServerUrl),
|
index("follows_followerServerUrl_idx").on(table.followerServerUrl),
|
||||||
|
|
|
||||||
|
|
@ -3,6 +3,7 @@ import { serverRegistry } from '@/lib/db/schema';
|
||||||
import { encryptPayload, getOwnSigningSecretKey, signMessage } from '@/lib/federation/keytools';
|
import { encryptPayload, getOwnSigningSecretKey, signMessage } from '@/lib/federation/keytools';
|
||||||
import { markServerHealthy, markServerUnhealthy } from '@/lib/federation/registry';
|
import { markServerHealthy, markServerUnhealthy } from '@/lib/federation/registry';
|
||||||
import { EMERGENCY_SWEEP_TIMEOUT, getThreatPolicy } from '@/lib/federation/threat-model';
|
import { EMERGENCY_SWEEP_TIMEOUT, getThreatPolicy } from '@/lib/federation/threat-model';
|
||||||
|
import { assertSafeUrl, UrlGuardError } from '@/lib/federation/url-guard';
|
||||||
import createDebug from 'debug';
|
import createDebug from 'debug';
|
||||||
import { and, desc, eq, ne } from 'drizzle-orm';
|
import { and, desc, eq, ne } from 'drizzle-orm';
|
||||||
|
|
||||||
|
|
@ -161,6 +162,15 @@ async function emergencySweep(excludeUrl: string): Promise<typeof serverRegistry
|
||||||
|
|
||||||
const results = await Promise.allSettled(
|
const results = await Promise.allSettled(
|
||||||
checkable.map(async (server) => {
|
checkable.map(async (server) => {
|
||||||
|
try {
|
||||||
|
assertSafeUrl(server.url);
|
||||||
|
} catch (err) {
|
||||||
|
if (err instanceof UrlGuardError) {
|
||||||
|
debug('emergency sweep: skipping %s — blocked URL: %s', server.url, err.message);
|
||||||
|
throw err;
|
||||||
|
}
|
||||||
|
throw err;
|
||||||
|
}
|
||||||
const res = await fetch(server.url + '/discover', {
|
const res = await fetch(server.url + '/discover', {
|
||||||
signal: AbortSignal.timeout(EMERGENCY_SWEEP_TIMEOUT),
|
signal: AbortSignal.timeout(EMERGENCY_SWEEP_TIMEOUT),
|
||||||
});
|
});
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,3 @@
|
||||||
import { binary_to_base58 } from "base58-js";
|
|
||||||
import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
|
import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
|
||||||
import nacl from "tweetnacl";
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
|
@ -74,8 +73,14 @@ export function decryptPayload(envelope: EncryptedEnvelope, ownX25519SecretKey:
|
||||||
const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
|
const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
|
||||||
return decrypted.toString("utf8");
|
return decrypted.toString("utf8");
|
||||||
} catch (error) {
|
} catch (error) {
|
||||||
console.error("If you're trying to rotate keys, then your old keys are invalid and doesn't match the keys that the other federation has. You'll have to contact that federation in order to rotate your keys.")
|
if (process.env.NODE_ENV !== "test") {
|
||||||
console.error("If you're not trying to rotate keys, then you're either doing something wrong or the other federation shouldn't be trusted anymore. Most likely the first.")
|
console.error(
|
||||||
|
"If you're trying to rotate keys, then your old keys are invalid and doesn't match the keys that the other federation has. You'll have to contact that federation in order to rotate your keys.",
|
||||||
|
);
|
||||||
|
console.error(
|
||||||
|
"If you're not trying to rotate keys, then you're either doing something wrong or the other federation shouldn't be trusted anymore. Most likely the first.",
|
||||||
|
);
|
||||||
|
}
|
||||||
throw error;
|
throw error;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
@ -85,6 +90,50 @@ export function fingerprintKey(keyBase64: string): string {
|
||||||
return hash;
|
return hash;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
|
||||||
|
const BASE58_MAP = new Uint8Array(256).fill(255);
|
||||||
|
for (let i = 0; i < BASE58_ALPHABET.length; i++) BASE58_MAP[BASE58_ALPHABET.charCodeAt(i)] = i;
|
||||||
|
|
||||||
|
export function binary_to_base58(bytes: Uint8Array): string {
|
||||||
|
const digits: number[] = [0];
|
||||||
|
for (const byte of bytes) {
|
||||||
|
let carry = byte;
|
||||||
|
for (let i = 0; i < digits.length; i++) {
|
||||||
|
carry += digits[i] << 8;
|
||||||
|
digits[i] = carry % 58;
|
||||||
|
carry = (carry / 58) | 0;
|
||||||
|
}
|
||||||
|
while (carry > 0) {
|
||||||
|
digits.push(carry % 58);
|
||||||
|
carry = (carry / 58) | 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
let result = "";
|
||||||
|
for (let i = 0; i < bytes.length && bytes[i] === 0; i++) result += "1";
|
||||||
|
for (let i = digits.length - 1; i >= 0; i--) result += BASE58_ALPHABET[digits[i]];
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
export function base58_to_binary(str: string): Uint8Array {
|
||||||
|
const bytes: number[] = [0];
|
||||||
|
for (const char of str) {
|
||||||
|
const value = BASE58_MAP[char.charCodeAt(0)];
|
||||||
|
if (value === 255) throw new Error(`Invalid base58 character: ${char}`);
|
||||||
|
let carry = value;
|
||||||
|
for (let i = 0; i < bytes.length; i++) {
|
||||||
|
carry += bytes[i] * 58;
|
||||||
|
bytes[i] = carry & 0xff;
|
||||||
|
carry >>= 8;
|
||||||
|
}
|
||||||
|
while (carry > 0) {
|
||||||
|
bytes.push(carry & 0xff);
|
||||||
|
carry >>= 8;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for (let i = 0; i < str.length && str[i] === "1"; i++) bytes.push(0);
|
||||||
|
return new Uint8Array(bytes.reverse());
|
||||||
|
}
|
||||||
|
|
||||||
export function generateUserKeyPair(): { fingerprint: string, signingPublicKey: string, signingSecretKey: string } {
|
export function generateUserKeyPair(): { fingerprint: string, signingPublicKey: string, signingSecretKey: string } {
|
||||||
const signing = nacl.sign.keyPair();
|
const signing = nacl.sign.keyPair();
|
||||||
|
|
||||||
|
|
@ -115,7 +164,7 @@ export function getOwnEncryptionPublicKey(): Uint8Array {
|
||||||
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"))
|
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"))
|
||||||
}
|
}
|
||||||
|
|
||||||
export function getOwnSigningPublicKey(): Uint8Array {
|
function getOwnSigningPublicKey(): Uint8Array {
|
||||||
return new Uint8Array(Buffer.from(process.env.FEDERATION_PUBLIC_KEY!, "base64"))
|
return new Uint8Array(Buffer.from(process.env.FEDERATION_PUBLIC_KEY!, "base64"))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -15,11 +15,11 @@ export type FederatedPostSender = {
|
||||||
|
|
||||||
export type FederatedPostResult =
|
export type FederatedPostResult =
|
||||||
| {
|
| {
|
||||||
ok: true;
|
ok: true;
|
||||||
innerPayload: string;
|
innerPayload: string;
|
||||||
signature: string;
|
signature: string;
|
||||||
senderEncryptionPublicKeyB64: string;
|
senderEncryptionPublicKeyB64: string;
|
||||||
}
|
}
|
||||||
| { ok: false; error: string; code: string; status: number };
|
| { ok: false; error: string; code: string; status: number };
|
||||||
|
|
||||||
export async function applyFederatedPostInTransaction(
|
export async function applyFederatedPostInTransaction(
|
||||||
|
|
|
||||||
|
|
@ -8,6 +8,7 @@ import { eq } from 'drizzle-orm';
|
||||||
const debug = createDebug('app:federation:registry');
|
const debug = createDebug('app:federation:registry');
|
||||||
|
|
||||||
export async function upsertServer(url: string, publicKey: string, encryptionPublicKey: string) {
|
export async function upsertServer(url: string, publicKey: string, encryptionPublicKey: string) {
|
||||||
|
assertSafeUrl(url);
|
||||||
return await db.insert(serverRegistry).values({
|
return await db.insert(serverRegistry).values({
|
||||||
id: crypto.randomUUID(),
|
id: crypto.randomUUID(),
|
||||||
url,
|
url,
|
||||||
|
|
@ -137,6 +138,10 @@ export async function discoverAndRegister(serverUrl: string): Promise<string> {
|
||||||
await upsertServer(echo.url, echo.publicKey, echo.encryptionPublicKey);
|
await upsertServer(echo.url, echo.publicKey, echo.encryptionPublicKey);
|
||||||
}
|
}
|
||||||
} catch (err) {
|
} catch (err) {
|
||||||
|
console.warn(
|
||||||
|
`[federation] Mutual REGISTER to ${serverUrl} failed (non-fatal):`,
|
||||||
|
err instanceof Error ? err.message : err,
|
||||||
|
);
|
||||||
debug('mutual REGISTER to %s failed (non-fatal): %s', serverUrl, err instanceof Error ? err.message : err);
|
debug('mutual REGISTER to %s failed (non-fatal): %s', serverUrl, err instanceof Error ? err.message : err);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
||||||
4
src/lib/http/json-object-body.ts
Normal file
4
src/lib/http/json-object-body.ts
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
/** True when JSON.parse-style output is a non-array record (expected root shape for POST JSON APIs). */
|
||||||
|
export function isJsonObjectBody(body: unknown): body is Record<string, unknown> {
|
||||||
|
return body !== null && typeof body === "object" && !Array.isArray(body);
|
||||||
|
}
|
||||||
51
src/lib/identity/followSignature.ts
Normal file
51
src/lib/identity/followSignature.ts
Normal file
|
|
@ -0,0 +1,51 @@
|
||||||
|
/**
|
||||||
|
* Canonical byte builders for follow-related signatures.
|
||||||
|
*
|
||||||
|
* Both client (signer) and server (verifier) import these functions to
|
||||||
|
* guarantee they operate on identical byte sequences
|
||||||
|
*
|
||||||
|
* The `federationUrl` field binds each signature to a specific server,
|
||||||
|
* preventing cross-server replay.
|
||||||
|
*/
|
||||||
|
|
||||||
|
export interface FollowRequestPayload {
|
||||||
|
followId: string;
|
||||||
|
followerId: string;
|
||||||
|
followingId: string;
|
||||||
|
createdAt: string;
|
||||||
|
/** The canonical URL of the server this follow request is being submitted to. */
|
||||||
|
federationUrl: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
export function canonicalFollowRequestBytes(payload: FollowRequestPayload): Uint8Array {
|
||||||
|
return new TextEncoder().encode(
|
||||||
|
JSON.stringify({
|
||||||
|
v: 2,
|
||||||
|
followId: payload.followId,
|
||||||
|
followerId: payload.followerId,
|
||||||
|
followingId: payload.followingId,
|
||||||
|
createdAt: payload.createdAt,
|
||||||
|
federationUrl: payload.federationUrl,
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface FollowResponsePayload {
|
||||||
|
followId: string;
|
||||||
|
response: "accept" | "reject";
|
||||||
|
timestamp: string;
|
||||||
|
/** The canonical URL of the server this response is submitted to. */
|
||||||
|
federationUrl: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
export function canonicalFollowResponseBytes(payload: FollowResponsePayload): Uint8Array {
|
||||||
|
return new TextEncoder().encode(
|
||||||
|
JSON.stringify({
|
||||||
|
v: 2,
|
||||||
|
followId: payload.followId,
|
||||||
|
response: payload.response,
|
||||||
|
timestamp: payload.timestamp,
|
||||||
|
federationUrl: payload.federationUrl,
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
@ -4,24 +4,45 @@
|
||||||
* and the server (to verify it), so any change here must ship to both sides
|
* and the server (to verify it), so any change here must ship to both sides
|
||||||
* simultaneously — bump `v` to invalidate old signatures during a migration.
|
* simultaneously — bump `v` to invalidate old signatures during a migration.
|
||||||
*
|
*
|
||||||
* V8 and JavaScriptCore both preserve string-key insertion order in
|
* Object keys inside `content` are sorted alphabetically before stringification
|
||||||
* `JSON.stringify`, which makes this output deterministic across the
|
* so that the canonical form is independent of insertion order. This matters
|
||||||
* browsers and Node versions we care about.
|
* because Zod rebuilds parsed objects in schema-definition key order, which
|
||||||
|
* differs from the order the client constructs content blocks.
|
||||||
|
*
|
||||||
|
* The `federationUrl` field binds the signature to a specific server,
|
||||||
|
* making cross-server signature replay infeasible.
|
||||||
*/
|
*/
|
||||||
export interface PostSignaturePayload {
|
export interface PostSignaturePayload {
|
||||||
postId: string;
|
postId: string;
|
||||||
authorId: string;
|
authorId: string;
|
||||||
publishedAt: string;
|
publishedAt: string;
|
||||||
content: unknown;
|
content: unknown;
|
||||||
|
/** The canonical URL of the server this post is being submitted to. */
|
||||||
|
federationUrl: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
function sortedReplacer(_key: string, value: unknown): unknown {
|
||||||
|
if (value !== null && typeof value === "object" && !Array.isArray(value)) {
|
||||||
|
return Object.fromEntries(
|
||||||
|
Object.entries(value as Record<string, unknown>).sort(([a], [b]) =>
|
||||||
|
a < b ? -1 : a > b ? 1 : 0,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
return value;
|
||||||
}
|
}
|
||||||
|
|
||||||
export function canonicalPostBytes(payload: PostSignaturePayload): Uint8Array {
|
export function canonicalPostBytes(payload: PostSignaturePayload): Uint8Array {
|
||||||
const canonical = JSON.stringify({
|
const canonical = JSON.stringify(
|
||||||
v: 1,
|
{
|
||||||
postId: payload.postId,
|
v: 2,
|
||||||
authorId: payload.authorId,
|
postId: payload.postId,
|
||||||
publishedAt: payload.publishedAt,
|
authorId: payload.authorId,
|
||||||
content: payload.content,
|
publishedAt: payload.publishedAt,
|
||||||
});
|
content: payload.content,
|
||||||
|
federationUrl: payload.federationUrl,
|
||||||
|
},
|
||||||
|
sortedReplacer,
|
||||||
|
);
|
||||||
return new TextEncoder().encode(canonical);
|
return new TextEncoder().encode(canonical);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
163
src/lib/identity/sessionKey.ts
Normal file
163
src/lib/identity/sessionKey.ts
Normal file
|
|
@ -0,0 +1,163 @@
|
||||||
|
import { getDb } from "@/lib/dexie";
|
||||||
|
import { decryptIdentity } from "@/lib/identity/sign";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Session key store — module memory + sessionStorage.
|
||||||
|
*
|
||||||
|
* The Ed25519 keypair is held in two places:
|
||||||
|
* 1. Module-level variables (fast path for the current execution context).
|
||||||
|
* 2. `sessionStorage` (survives page reloads in the same tab; cleared
|
||||||
|
* automatically when the tab is closed or on explicit logout).
|
||||||
|
*
|
||||||
|
* Security notes
|
||||||
|
* --------------
|
||||||
|
* `sessionStorage` and module variables share the same JavaScript execution
|
||||||
|
* context, so their XSS attack surfaces are identical — an attacker who can
|
||||||
|
* run arbitrary script in the page can read either. Using sessionStorage does
|
||||||
|
* NOT introduce any new attack surface over pure in-memory storage.
|
||||||
|
*
|
||||||
|
* What sessionStorage buys us: the key survives `window.location` navigations
|
||||||
|
* and hard reloads within the same browser tab without the user having to
|
||||||
|
* re-enter their master password each time. It is NOT shared across tabs
|
||||||
|
* (unlike localStorage), and it is cleared when the tab is closed.
|
||||||
|
*
|
||||||
|
* `localStorage` is intentionally NOT used — it would persist across browser
|
||||||
|
* restarts and across ALL tabs, which is an unacceptable persistence scope
|
||||||
|
* for signing key material.
|
||||||
|
*/
|
||||||
|
|
||||||
|
const SK_PREFIX = "sipher:sk:";
|
||||||
|
|
||||||
|
let _secretKey: Uint8Array | null = null;
|
||||||
|
let _publicKey: Uint8Array | null = null;
|
||||||
|
|
||||||
|
// --- Reactivity ---------------------------------------------------------
|
||||||
|
|
||||||
|
type LockListener = (isUnlocked: boolean) => void;
|
||||||
|
const _listeners = new Set<LockListener>();
|
||||||
|
|
||||||
|
function _notify(isUnlocked: boolean) {
|
||||||
|
for (const fn of _listeners) fn(isUnlocked);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Subscribe to lock-state changes. Returns an unsubscribe function.
|
||||||
|
* Called with `true` when the key is unlocked, `false` when cleared.
|
||||||
|
*
|
||||||
|
* Useful for React hooks that need to re-render when the identity
|
||||||
|
* becomes available or is revoked (e.g. the unlock modal).
|
||||||
|
*/
|
||||||
|
export function onLockChange(fn: LockListener): () => void {
|
||||||
|
_listeners.add(fn);
|
||||||
|
return () => { _listeners.delete(fn); };
|
||||||
|
}
|
||||||
|
|
||||||
|
// ------------------------------------------------------------------------
|
||||||
|
|
||||||
|
/** True once `unlockSessionKey` has been called successfully this session. */
|
||||||
|
export function isKeyUnlocked(): boolean {
|
||||||
|
return _secretKey !== null;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Decrypt the identity blob from Dexie and hold the keypair in memory for
|
||||||
|
* the rest of the session. Returns the public key so callers can confirm
|
||||||
|
* which identity was unlocked. Throws on wrong password (GCM auth failure)
|
||||||
|
* or missing identity record.
|
||||||
|
*/
|
||||||
|
export async function unlockSessionKey(userId: string, password: string): Promise<Uint8Array> {
|
||||||
|
const record = await getDb().identity.get(userId);
|
||||||
|
if (!record) throw new Error("No identity found on this device for this user.");
|
||||||
|
|
||||||
|
const parsed = await decryptIdentity(record, password);
|
||||||
|
|
||||||
|
// Zero any prior key before overwriting, in case of re-unlock.
|
||||||
|
_secretKey?.fill(0);
|
||||||
|
|
||||||
|
_secretKey = new Uint8Array(parsed.secretKey);
|
||||||
|
_publicKey = new Uint8Array(parsed.publicKey);
|
||||||
|
|
||||||
|
_persist(userId, _secretKey, _publicKey);
|
||||||
|
_notify(true);
|
||||||
|
return _publicKey;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Restore the keypair from `sessionStorage` without requiring the master
|
||||||
|
* password again. Called automatically on page load by `UnlockIdentityModal`.
|
||||||
|
*
|
||||||
|
* Returns `true` if the key was successfully restored, `false` if the tab is
|
||||||
|
* fresh (no stored key) or the stored value is corrupt.
|
||||||
|
*/
|
||||||
|
export function restoreSessionKey(userId: string): boolean {
|
||||||
|
if (typeof sessionStorage === "undefined") return false;
|
||||||
|
try {
|
||||||
|
const secretB64 = sessionStorage.getItem(`${SK_PREFIX}${userId}:s`);
|
||||||
|
const publicB64 = sessionStorage.getItem(`${SK_PREFIX}${userId}:p`);
|
||||||
|
if (!secretB64 || !publicB64) return false;
|
||||||
|
|
||||||
|
_secretKey?.fill(0);
|
||||||
|
_secretKey = Uint8Array.from(Buffer.from(secretB64, "base64"));
|
||||||
|
_publicKey = Uint8Array.from(Buffer.from(publicB64, "base64"));
|
||||||
|
|
||||||
|
_notify(true);
|
||||||
|
return true;
|
||||||
|
} catch {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Produce a detached Ed25519 signature over `message`.
|
||||||
|
* Throws `"Identity not unlocked"` if `unlockSessionKey` has not been called.
|
||||||
|
*/
|
||||||
|
export function sign(message: Uint8Array): Uint8Array {
|
||||||
|
if (!_secretKey) throw new Error("Identity not unlocked. Call unlockSessionKey first.");
|
||||||
|
return nacl.sign.detached(message, _secretKey);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Returns the cached public key, or `null` if not yet unlocked. */
|
||||||
|
export function getPublicKey(): Uint8Array | null {
|
||||||
|
return _publicKey;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Zero the in-memory secret and drop the reference. Must be called on logout
|
||||||
|
* so the key doesn't outlive the authenticated session.
|
||||||
|
*/
|
||||||
|
export function clearSessionKey(): void {
|
||||||
|
_secretKey?.fill(0);
|
||||||
|
_secretKey = null;
|
||||||
|
_publicKey = null;
|
||||||
|
_clearStorage();
|
||||||
|
_notify(false);
|
||||||
|
}
|
||||||
|
|
||||||
|
// --- sessionStorage helpers ---------------------------------------------
|
||||||
|
|
||||||
|
function _persist(userId: string, secret: Uint8Array, pub: Uint8Array) {
|
||||||
|
if (typeof sessionStorage === "undefined") return;
|
||||||
|
try {
|
||||||
|
sessionStorage.setItem(`${SK_PREFIX}${userId}:s`, Buffer.from(secret).toString("base64"));
|
||||||
|
sessionStorage.setItem(`${SK_PREFIX}${userId}:p`, Buffer.from(pub).toString("base64"));
|
||||||
|
sessionStorage.setItem(`${SK_PREFIX}current`, userId);
|
||||||
|
} catch {
|
||||||
|
// Quota exceeded or private browsing — silently ignore; the key is
|
||||||
|
// still available in the module-level variables for this page load.
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function _clearStorage() {
|
||||||
|
if (typeof sessionStorage === "undefined") return;
|
||||||
|
try {
|
||||||
|
const userId = sessionStorage.getItem(`${SK_PREFIX}current`);
|
||||||
|
if (userId) {
|
||||||
|
sessionStorage.removeItem(`${SK_PREFIX}${userId}:s`);
|
||||||
|
sessionStorage.removeItem(`${SK_PREFIX}${userId}:p`);
|
||||||
|
}
|
||||||
|
sessionStorage.removeItem(`${SK_PREFIX}current`);
|
||||||
|
} catch {
|
||||||
|
// ignore
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -3,14 +3,16 @@ import { gcm } from "@noble/ciphers/aes.js";
|
||||||
import { pbkdf2Async } from "@noble/hashes/pbkdf2.js";
|
import { pbkdf2Async } from "@noble/hashes/pbkdf2.js";
|
||||||
import { sha256 } from "@noble/hashes/sha2.js";
|
import { sha256 } from "@noble/hashes/sha2.js";
|
||||||
import nacl from "tweetnacl";
|
import nacl from "tweetnacl";
|
||||||
|
import { getPublicKey, isKeyUnlocked, sign as sessionSign } from "./sessionKey";
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Plaintext shape inside the AES-GCM-sealed identity blob in Dexie.
|
* Plaintext shape inside the AES-GCM-sealed identity blob in Dexie.
|
||||||
* The mnemonic + secret key combined make this the only thing in the system
|
* Contains the keypair needed for signing.
|
||||||
* capable of producing valid signatures for the user's identity.
|
* The BIP-39 mnemonic used to derive the keypair is NOT stored here
|
||||||
|
* (shown once during creation, then discarded).
|
||||||
*/
|
*/
|
||||||
interface IdentityPlaintext {
|
interface IdentityPlaintext {
|
||||||
mnemonic: string;
|
mnemonic?: string;
|
||||||
fingerprint: string;
|
fingerprint: string;
|
||||||
publicKey: number[];
|
publicKey: number[];
|
||||||
secretKey: number[];
|
secretKey: number[];
|
||||||
|
|
@ -39,15 +41,23 @@ export async function decryptIdentity(
|
||||||
/**
|
/**
|
||||||
* Sign one message with the user's Ed25519 identity secret key.
|
* Sign one message with the user's Ed25519 identity secret key.
|
||||||
*
|
*
|
||||||
* Decrypts the keypair, produces a single detached signature, then zeroes the
|
* Fast path: if the session key store has already been unlocked (typical
|
||||||
* secret bytes from memory before returning. Returns `null` if the user has
|
* during an active session), signs without a Dexie read or PBKDF2.
|
||||||
* no identity stored locally on this device.
|
*
|
||||||
|
* Cold path: decrypts the keypair from Dexie using `password`, signs, and
|
||||||
|
* zeroes the in-memory secret immediately. Returns `null` if the user has
|
||||||
|
* no identity stored on this device.
|
||||||
*/
|
*/
|
||||||
export async function signWithLocalIdentity(
|
async function signWithLocalIdentity(
|
||||||
userId: string,
|
userId: string,
|
||||||
password: string,
|
password: string,
|
||||||
message: Uint8Array,
|
message: Uint8Array,
|
||||||
): Promise<{ signature: Uint8Array; publicKey: Uint8Array } | null> {
|
): Promise<{ signature: Uint8Array; publicKey: Uint8Array } | null> {
|
||||||
|
if (isKeyUnlocked()) {
|
||||||
|
const publicKey = getPublicKey()!;
|
||||||
|
return { signature: sessionSign(message), publicKey };
|
||||||
|
}
|
||||||
|
|
||||||
const record = await getDb().identity.get(userId);
|
const record = await getDb().identity.get(userId);
|
||||||
if (!record) return null;
|
if (!record) return null;
|
||||||
|
|
||||||
|
|
|
||||||
24
src/lib/identity/useIdentityLock.ts
Normal file
24
src/lib/identity/useIdentityLock.ts
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
"use client";
|
||||||
|
|
||||||
|
import { useEffect, useState } from "react";
|
||||||
|
import { isKeyUnlocked, onLockChange } from "./sessionKey";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Reactive wrapper around the module-level session key store.
|
||||||
|
*
|
||||||
|
* Returns `true` once `unlockSessionKey` has been called this session,
|
||||||
|
* and `false` immediately after `clearSessionKey` (logout / tab refresh).
|
||||||
|
* Components using this hook re-render automatically on both transitions.
|
||||||
|
*/
|
||||||
|
export function useIdentityLock(): boolean {
|
||||||
|
const [unlocked, setUnlocked] = useState(isKeyUnlocked);
|
||||||
|
|
||||||
|
useEffect(() => {
|
||||||
|
// Sync with any unlock that happened before this component mounted
|
||||||
|
// (e.g. createOvenIdentity auto-unlock).
|
||||||
|
setUnlocked(isKeyUnlocked());
|
||||||
|
return onLockChange(setUnlocked);
|
||||||
|
}, []);
|
||||||
|
|
||||||
|
return unlocked;
|
||||||
|
}
|
||||||
|
|
@ -1,4 +1,6 @@
|
||||||
import { getDb } from "@/lib/dexie";
|
import { getDb } from "@/lib/dexie";
|
||||||
|
import { binary_to_base58 } from "@/lib/federation/keytools";
|
||||||
|
import { unlockSessionKey } from "@/lib/identity/sessionKey";
|
||||||
import { decryptIdentity } from "@/lib/identity/sign";
|
import { decryptIdentity } from "@/lib/identity/sign";
|
||||||
import type { KeysUploadRequest } from "@matrix-org/matrix-sdk-crypto-wasm";
|
import type { KeysUploadRequest } from "@matrix-org/matrix-sdk-crypto-wasm";
|
||||||
import { gcm } from "@noble/ciphers/aes.js";
|
import { gcm } from "@noble/ciphers/aes.js";
|
||||||
|
|
@ -8,7 +10,6 @@ import { sha256 } from "@noble/hashes/sha2.js";
|
||||||
import { randomBytes } from "@noble/hashes/utils.js";
|
import { randomBytes } from "@noble/hashes/utils.js";
|
||||||
import * as bip39 from "@scure/bip39";
|
import * as bip39 from "@scure/bip39";
|
||||||
import { wordlist } from "@scure/bip39/wordlists/english.js";
|
import { wordlist } from "@scure/bip39/wordlists/english.js";
|
||||||
import { binary_to_base58 } from "base58-js";
|
|
||||||
import type { BetterAuthClientPlugin } from "better-auth/client";
|
import type { BetterAuthClientPlugin } from "better-auth/client";
|
||||||
import nacl from "tweetnacl";
|
import nacl from "tweetnacl";
|
||||||
import type { sipherOven } from "../server";
|
import type { sipherOven } from "../server";
|
||||||
|
|
@ -66,7 +67,6 @@ export const sipherOvenClientPlugin = () => {
|
||||||
const iv = randomBytes(12);
|
const iv = randomBytes(12);
|
||||||
const aesKey = await pbkdf2Async(sha256, password, salt, { c: 600_000, dkLen: 32 });
|
const aesKey = await pbkdf2Async(sha256, password, salt, { c: 600_000, dkLen: 32 });
|
||||||
const plaintext = new TextEncoder().encode(JSON.stringify({
|
const plaintext = new TextEncoder().encode(JSON.stringify({
|
||||||
mnemonic,
|
|
||||||
fingerprint,
|
fingerprint,
|
||||||
publicKey: Array.from(publicKey),
|
publicKey: Array.from(publicKey),
|
||||||
secretKey: Array.from(secretKey),
|
secretKey: Array.from(secretKey),
|
||||||
|
|
@ -83,7 +83,7 @@ export const sipherOvenClientPlugin = () => {
|
||||||
|
|
||||||
const { error: registerError } = await $fetch<{ success: boolean }>("/oven/identity/register", {
|
const { error: registerError } = await $fetch<{ success: boolean }>("/oven/identity/register", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
body: { signingPublicKey: binary_to_base58(publicKey), fingerprint },
|
body: { signingPublicKey: publicKey, fingerprint },
|
||||||
});
|
});
|
||||||
if (registerError) {
|
if (registerError) {
|
||||||
console.error("[createOvenIdentity]", registerError);
|
console.error("[createOvenIdentity]", registerError);
|
||||||
|
|
@ -119,6 +119,10 @@ export const sipherOvenClientPlugin = () => {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Auto-unlock the session key store so the user's first post/follow
|
||||||
|
// doesn't require a re-prompt immediately after creation.
|
||||||
|
await unlockSessionKey(username, password);
|
||||||
|
|
||||||
return { userId, deviceId, machine, fingerprint, publicKey, mnemonic };
|
return { userId, deviceId, machine, fingerprint, publicKey, mnemonic };
|
||||||
},
|
},
|
||||||
|
|
||||||
|
|
@ -134,7 +138,7 @@ export const sipherOvenClientPlugin = () => {
|
||||||
const parsed = await decryptIdentity(record, password);
|
const parsed = await decryptIdentity(record, password);
|
||||||
|
|
||||||
return {
|
return {
|
||||||
mnemonic: parsed.mnemonic,
|
mnemonic: parsed.mnemonic ?? null,
|
||||||
fingerprint: parsed.fingerprint,
|
fingerprint: parsed.fingerprint,
|
||||||
publicKey: new Uint8Array(parsed.publicKey),
|
publicKey: new Uint8Array(parsed.publicKey),
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -138,6 +138,11 @@ export const sipherOven = () => {
|
||||||
const { signingPublicKey, fingerprint } = context.body;
|
const { signingPublicKey, fingerprint } = context.body;
|
||||||
const now = new Date();
|
const now = new Date();
|
||||||
|
|
||||||
|
const checkIdentity = await db.select().from(userIdentityKeys).where(eq(userIdentityKeys.userId, session.user.id)).limit(1);
|
||||||
|
if (checkIdentity.length > 0) {
|
||||||
|
return context.json({ error: "Identity already registered, if you need to rotate your keys, please use the key rotation flow instead." }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
await db.transaction(async (tx) => {
|
await db.transaction(async (tx) => {
|
||||||
const updated = await tx
|
const updated = await tx
|
||||||
.update(userIdentityKeys)
|
.update(userIdentityKeys)
|
||||||
|
|
|
||||||
|
|
@ -57,7 +57,7 @@ export const KeysUploadBodySchema = z
|
||||||
{ message: "At least one of device_keys, one_time_keys, or fallback_keys must be present" },
|
{ message: "At least one of device_keys, one_time_keys, or fallback_keys must be present" },
|
||||||
);
|
);
|
||||||
|
|
||||||
export type KeysUploadBody = z.infer<typeof KeysUploadBodySchema>;
|
type KeysUploadBody = z.infer<typeof KeysUploadBodySchema>;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Body for `POST /oven/identity/register`.
|
* Body for `POST /oven/identity/register`.
|
||||||
|
|
@ -76,4 +76,4 @@ export const IdentityRegisterBodySchema = z.object({
|
||||||
fingerprint: z.string().min(1),
|
fingerprint: z.string().min(1),
|
||||||
});
|
});
|
||||||
|
|
||||||
export type IdentityRegisterBody = z.infer<typeof IdentityRegisterBodySchema>;
|
type IdentityRegisterBody = z.infer<typeof IdentityRegisterBodySchema>;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,6 @@
|
||||||
|
import { canonicalFollowRequestBytes, canonicalFollowResponseBytes } from "@/lib/identity/followSignature";
|
||||||
import { canonicalPostBytes } from "@/lib/identity/postSignature";
|
import { canonicalPostBytes } from "@/lib/identity/postSignature";
|
||||||
import { signWithLocalIdentity } from "@/lib/identity/sign";
|
import { isKeyUnlocked, sign as sessionSign } from "@/lib/identity/sessionKey";
|
||||||
import type { BetterAuthClientPlugin } from "better-auth/client";
|
import type { BetterAuthClientPlugin } from "better-auth/client";
|
||||||
import { v4 } from "uuid";
|
import { v4 } from "uuid";
|
||||||
import { z } from "zod";
|
import { z } from "zod";
|
||||||
|
|
@ -33,21 +34,20 @@ export const sipherSocialClientPlugin = () => {
|
||||||
/**
|
/**
|
||||||
* Author and submit a post.
|
* Author and submit a post.
|
||||||
*
|
*
|
||||||
* Each post is detached-Ed25519-signed by the user's mnemonic-derived
|
* Each post is detached-Ed25519-signed via the in-memory session key
|
||||||
* identity key. The matching secret is decrypted in memory only for
|
* store (populated once at login / identity creation). The server
|
||||||
* the duration of the signing call (see `signWithLocalIdentity`),
|
* verifies the signature against the user's registered
|
||||||
* then zeroed. The server verifies the signature against the user's
|
* `signingPublicKey` before persisting the post.
|
||||||
* registered `signingPublicKey` before persisting the post.
|
|
||||||
*
|
*
|
||||||
* @param content Content blocks (text/media/link).
|
* Throws `"Identity not unlocked"` if `unlockSessionKey` has not been
|
||||||
* @param userId Better Auth user id of the author (the same id
|
* called this session (e.g. a fresh tab opened without a login prompt).
|
||||||
* used when the identity was created).
|
*
|
||||||
* @param password Master password that unlocks the local identity.
|
* @param content Content blocks (text/media/link).
|
||||||
|
* @param userId Better Auth user id of the author.
|
||||||
*/
|
*/
|
||||||
createPost: async (
|
createPost: async (
|
||||||
content: z.infer<typeof clientPostContentSchmema>,
|
content: z.infer<typeof clientPostContentSchmema>,
|
||||||
userId: string,
|
userId: string,
|
||||||
password: string,
|
|
||||||
) => {
|
) => {
|
||||||
// Allow only these combinations of content:
|
// Allow only these combinations of content:
|
||||||
// 1. Text only
|
// 1. Text only
|
||||||
|
|
@ -70,12 +70,24 @@ export const sipherSocialClientPlugin = () => {
|
||||||
if (videoCount > MAX_VIDEO_COUNT) throw new Error("Maximum number of videos per post exceeded");
|
if (videoCount > MAX_VIDEO_COUNT) throw new Error("Maximum number of videos per post exceeded");
|
||||||
if (audioCount > MAX_AUDIO_COUNT) throw new Error("Maximum number of audios per post exceeded");
|
if (audioCount > MAX_AUDIO_COUNT) throw new Error("Maximum number of audios per post exceeded");
|
||||||
|
|
||||||
const resolvedContent: { type: string; value?: string; url?: string; size?: number; index?: number }[] = [];
|
type ResolvedBlock =
|
||||||
|
| { type: "text"; value: string }
|
||||||
|
| { type: "link"; url: string }
|
||||||
|
| { type: "image"; url: string; size: number; index: number }
|
||||||
|
| { type: "video"; url: string; size: number; index: number }
|
||||||
|
| { type: "audio"; url: string; size: number };
|
||||||
|
|
||||||
|
const resolvedContent: ResolvedBlock[] = [];
|
||||||
let mediaIndex = 0;
|
let mediaIndex = 0;
|
||||||
|
|
||||||
for (const block of content) {
|
for (const block of content) {
|
||||||
if (block.type === "text" || block.type === "link") {
|
if (block.type === "text") {
|
||||||
resolvedContent.push({ type: block.type, value: block.value as string });
|
resolvedContent.push({ type: "text", value: block.value as string });
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (block.type === "link") {
|
||||||
|
resolvedContent.push({ type: "link", url: block.value as string });
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -108,27 +120,31 @@ export const sipherSocialClientPlugin = () => {
|
||||||
throw new Error(`Failed to upload ${file.name}`);
|
throw new Error(`Failed to upload ${file.name}`);
|
||||||
}
|
}
|
||||||
|
|
||||||
resolvedContent.push({
|
if (block.type === "audio") {
|
||||||
type: block.type,
|
resolvedContent.push({ type: "audio", url: data.objectUrl, size: file.size });
|
||||||
url: data.objectUrl,
|
} else {
|
||||||
size: file.size,
|
resolvedContent.push({
|
||||||
index: mediaIndex++,
|
type: block.type as "image" | "video",
|
||||||
});
|
url: data.objectUrl,
|
||||||
|
size: file.size,
|
||||||
|
index: mediaIndex++,
|
||||||
|
});
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
const postId = v4()
|
const postId = v4();
|
||||||
const publishedAt = new Date().toISOString();
|
const publishedAt = new Date().toISOString();
|
||||||
|
|
||||||
const signed = await signWithLocalIdentity(
|
if (!isKeyUnlocked()) {
|
||||||
userId,
|
throw new Error("Identity not unlocked. Please enter your master password to unlock signing.");
|
||||||
password,
|
|
||||||
canonicalPostBytes({ postId, authorId: userId, publishedAt, content: resolvedContent }),
|
|
||||||
);
|
|
||||||
if (!signed) {
|
|
||||||
throw new Error("No local identity found on this device. Create one before posting.");
|
|
||||||
}
|
}
|
||||||
|
|
||||||
const signature = Buffer.from(signed.signature).toString("base64");
|
const federationUrl = (options as { baseURL?: string } | undefined)?.baseURL
|
||||||
|
?? (typeof window !== "undefined" ? window.location.origin : "");
|
||||||
|
const sigBytes = sessionSign(
|
||||||
|
canonicalPostBytes({ postId, authorId: userId, publishedAt, content: resolvedContent, federationUrl }),
|
||||||
|
);
|
||||||
|
const signature = Buffer.from(sigBytes).toString("base64");
|
||||||
|
|
||||||
const { data, error } = await $fetch<{ id: string; federationDeliveriesQueued: number }>(
|
const { data, error } = await $fetch<{ id: string; federationDeliveriesQueued: number }>(
|
||||||
"/social/posts",
|
"/social/posts",
|
||||||
|
|
@ -149,10 +165,43 @@ export const sipherSocialClientPlugin = () => {
|
||||||
|
|
||||||
return { id: data.id, federationDeliveriesQueued: data.federationDeliveriesQueued };
|
return { id: data.id, federationDeliveriesQueued: data.federationDeliveriesQueued };
|
||||||
},
|
},
|
||||||
followUser: async (userId: string, federationUrl?: string) => {
|
/**
|
||||||
|
* Send a signed follow request to another user.
|
||||||
|
*
|
||||||
|
* The requester's Ed25519 identity key (from the session store) signs
|
||||||
|
* a canonical payload covering `followId`, `followerId`, `followingId`,
|
||||||
|
* and `createdAt`. The server verifies before persisting.
|
||||||
|
*
|
||||||
|
* Throws `"Identity not unlocked"` if the session key store is cold.
|
||||||
|
*
|
||||||
|
* @param targetUserId The user being followed.
|
||||||
|
* @param currentUserId The authenticated user making the request (used
|
||||||
|
* in the canonical signature payload; must match
|
||||||
|
* the session on the server).
|
||||||
|
*/
|
||||||
|
followUser: async (targetUserId: string, currentUserId: string, federationUrl?: string) => {
|
||||||
|
if (!isKeyUnlocked()) {
|
||||||
|
throw new Error("Identity not unlocked. Please enter your master password to unlock signing.");
|
||||||
|
}
|
||||||
|
|
||||||
|
const followId = v4();
|
||||||
|
const createdAt = new Date().toISOString();
|
||||||
|
|
||||||
|
const ownServerUrl = (options as { baseURL?: string } | undefined)?.baseURL
|
||||||
|
?? (typeof window !== "undefined" ? window.location.origin : "");
|
||||||
|
const sigBytes = sessionSign(
|
||||||
|
canonicalFollowRequestBytes({
|
||||||
|
followId, followerId: currentUserId, followingId: targetUserId, createdAt,
|
||||||
|
federationUrl: ownServerUrl,
|
||||||
|
}),
|
||||||
|
);
|
||||||
|
|
||||||
const body: Record<string, string> = {
|
const body: Record<string, string> = {
|
||||||
method: "INSERT",
|
method: "INSERT",
|
||||||
userId,
|
userId: targetUserId,
|
||||||
|
followId,
|
||||||
|
createdAt,
|
||||||
|
signature: Buffer.from(sigBytes).toString("base64"),
|
||||||
};
|
};
|
||||||
if (federationUrl) {
|
if (federationUrl) {
|
||||||
body.federationUrl = federationUrl;
|
body.federationUrl = federationUrl;
|
||||||
|
|
@ -174,6 +223,46 @@ export const sipherSocialClientPlugin = () => {
|
||||||
throw new Error("Failed to follow user");
|
throw new Error("Failed to follow user");
|
||||||
}
|
}
|
||||||
return data.following;
|
return data.following;
|
||||||
|
},
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Accept or reject a pending follow request.
|
||||||
|
*
|
||||||
|
* The responder's Ed25519 identity key signs a canonical payload
|
||||||
|
* covering `followId`, `response`, and `timestamp`. The server
|
||||||
|
* verifies and updates the follow row.
|
||||||
|
*
|
||||||
|
* Throws `"Identity not unlocked"` if the session key store is cold.
|
||||||
|
*/
|
||||||
|
respondToFollow: async (followId: string, response: "accept" | "reject") => {
|
||||||
|
if (!isKeyUnlocked()) {
|
||||||
|
throw new Error("Identity not unlocked. Please enter your master password to unlock signing.");
|
||||||
|
}
|
||||||
|
|
||||||
|
const timestamp = new Date().toISOString();
|
||||||
|
const ownServerUrl = (options as { baseURL?: string } | undefined)?.baseURL
|
||||||
|
?? (typeof window !== "undefined" ? window.location.origin : "");
|
||||||
|
const sigBytes = sessionSign(
|
||||||
|
canonicalFollowResponseBytes({ followId, response, timestamp, federationUrl: ownServerUrl }),
|
||||||
|
);
|
||||||
|
const signature = Buffer.from(sigBytes).toString("base64");
|
||||||
|
|
||||||
|
const { data, error } = await $fetch<{
|
||||||
|
follow: {
|
||||||
|
id: string;
|
||||||
|
accepted: boolean;
|
||||||
|
followerId: string;
|
||||||
|
followingId: string;
|
||||||
|
responderSignature: string;
|
||||||
|
};
|
||||||
|
}>("/social/follows", {
|
||||||
|
method: "POST",
|
||||||
|
body: { method: "RESPOND", followId, response, timestamp, signature },
|
||||||
|
});
|
||||||
|
if (error || !data) {
|
||||||
|
throw new Error("Failed to respond to follow request");
|
||||||
|
}
|
||||||
|
return data.follow;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,93 @@
|
||||||
import { createAuthEndpoint } from "better-auth/api"
|
import db from "@/lib/db";
|
||||||
import { z } from "zod"
|
import { blocks, follows } from "@/lib/db/schema";
|
||||||
|
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
||||||
|
import { and, eq } from "drizzle-orm";
|
||||||
|
import { z } from "zod";
|
||||||
|
|
||||||
export const createBlock = createAuthEndpoint("/social/blocks", {
|
export const createBlock = createAuthEndpoint("/social/blocks", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
}, async (context) => { })
|
body: z.object({
|
||||||
|
userId: z.string().min(1),
|
||||||
|
}),
|
||||||
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const { userId: blockedUserId } = context.body;
|
||||||
|
|
||||||
|
if (blockedUserId === session.user.id) {
|
||||||
|
return context.json({ error: "You cannot block yourself." }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const [existing] = await db
|
||||||
|
.select({ id: blocks.id })
|
||||||
|
.from(blocks)
|
||||||
|
.where(and(eq(blocks.blockerId, session.user.id), eq(blocks.blockedUserId, blockedUserId)))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (existing) {
|
||||||
|
return context.json({ error: "User is already blocked." }, { status: 409 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const [block] = await db
|
||||||
|
.insert(blocks)
|
||||||
|
.values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
blockerId: session.user.id,
|
||||||
|
blockedUserId,
|
||||||
|
createdAt: new Date(),
|
||||||
|
})
|
||||||
|
.returning();
|
||||||
|
|
||||||
|
// Remove any existing follow relationship in both directions.
|
||||||
|
await db.delete(follows).where(
|
||||||
|
and(eq(follows.followerId, session.user.id), eq(follows.followingId, blockedUserId)),
|
||||||
|
);
|
||||||
|
await db.delete(follows).where(
|
||||||
|
and(eq(follows.followerId, blockedUserId), eq(follows.followingId, session.user.id)),
|
||||||
|
);
|
||||||
|
|
||||||
|
return context.json({ block }, { status: 201 });
|
||||||
|
});
|
||||||
|
|
||||||
export const deleteBlock = createAuthEndpoint("/social/blocks/:id", {
|
export const deleteBlock = createAuthEndpoint("/social/blocks/:id", {
|
||||||
method: "DELETE",
|
method: "DELETE",
|
||||||
params: z.object({
|
params: z.object({
|
||||||
id: z.string(),
|
id: z.string(),
|
||||||
}),
|
}),
|
||||||
}, async (context) => { })
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const { id } = context.params;
|
||||||
|
|
||||||
|
const [block] = await db
|
||||||
|
.select({ id: blocks.id, blockerId: blocks.blockerId })
|
||||||
|
.from(blocks)
|
||||||
|
.where(eq(blocks.id, id))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!block) return context.json({ error: "Block not found." }, { status: 404 });
|
||||||
|
|
||||||
|
if (block.blockerId !== session.user.id) {
|
||||||
|
return context.json({ error: "Forbidden." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
await db.delete(blocks).where(eq(blocks.id, id));
|
||||||
|
|
||||||
|
return context.json({ success: true }, { status: 200 });
|
||||||
|
});
|
||||||
|
|
||||||
export const getBlocks = createAuthEndpoint("/social/blocks", {
|
export const getBlocks = createAuthEndpoint("/social/blocks", {
|
||||||
method: "GET",
|
method: "GET",
|
||||||
}, async (context) => { })
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const userBlocks = await db
|
||||||
|
.select()
|
||||||
|
.from(blocks)
|
||||||
|
.where(eq(blocks.blockerId, session.user.id));
|
||||||
|
|
||||||
|
return context.json({ blocks: userBlocks }, { status: 200 });
|
||||||
|
});
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,15 @@
|
||||||
import { getFederationQueue } from "@/lib/bull";
|
import { getFederationQueue } from "@/lib/bull";
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { blacklistedServers, deliveryJobs, follows, serverRegistry, user } from "@/lib/db/schema";
|
import { blacklistedServers, blocks, deliveryJobs, follows, serverRegistry, user, userIdentityKeys } from "@/lib/db/schema";
|
||||||
import { verifySignature } from "@/lib/federation/keytools";
|
import { base58_to_binary, verifySignature } from "@/lib/federation/keytools";
|
||||||
import { peerRegistryUrlOrNull } from "@/lib/federation/peer-registry-url";
|
import { peerRegistryUrlOrNull } from "@/lib/federation/peer-registry-url";
|
||||||
import { discoverAndRegister, DiscoveryError } from "@/lib/federation/registry";
|
import { discoverAndRegister, DiscoveryError } from "@/lib/federation/registry";
|
||||||
|
import { canonicalFollowRequestBytes, canonicalFollowResponseBytes } from "@/lib/identity/followSignature";
|
||||||
import { FollowEnvelopeSchema } from "@/lib/zod/methods/FollowSchema";
|
import { FollowEnvelopeSchema } from "@/lib/zod/methods/FollowSchema";
|
||||||
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
||||||
import createDebug from "debug";
|
import createDebug from "debug";
|
||||||
import { and, eq } from "drizzle-orm";
|
import { and, eq } from "drizzle-orm";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
import { z } from "zod";
|
import { z } from "zod";
|
||||||
|
|
||||||
const debug = createDebug("app:plugins:server:helpers:social:follows");
|
const debug = createDebug("app:plugins:server:helpers:social:follows");
|
||||||
|
|
@ -17,6 +19,9 @@ const followSchema = z.discriminatedUnion(
|
||||||
z.object({
|
z.object({
|
||||||
method: z.literal("INSERT"),
|
method: z.literal("INSERT"),
|
||||||
userId: z.string(),
|
userId: z.string(),
|
||||||
|
followId: z.string().uuid(),
|
||||||
|
createdAt: z.string().datetime(),
|
||||||
|
signature: z.string().min(1),
|
||||||
federationUrl: z.url().optional(),
|
federationUrl: z.url().optional(),
|
||||||
}),
|
}),
|
||||||
z.object({
|
z.object({
|
||||||
|
|
@ -28,6 +33,13 @@ const followSchema = z.discriminatedUnion(
|
||||||
method: z.literal("UNFOLLOW"),
|
method: z.literal("UNFOLLOW"),
|
||||||
userId: z.string(),
|
userId: z.string(),
|
||||||
}),
|
}),
|
||||||
|
z.object({
|
||||||
|
method: z.literal("RESPOND"),
|
||||||
|
followId: z.string().uuid(),
|
||||||
|
response: z.enum(["accept", "reject"]),
|
||||||
|
timestamp: z.string().datetime(),
|
||||||
|
signature: z.string().min(1),
|
||||||
|
}),
|
||||||
], { error: "Invalid follow method" },
|
], { error: "Invalid follow method" },
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
@ -44,7 +56,36 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
return context.json({ error: "Unauthorized" }, { status: 401 });
|
return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
};
|
};
|
||||||
|
|
||||||
const { userId, federationUrl } = context.body;
|
const { userId, federationUrl, followId, createdAt, signature } = context.body;
|
||||||
|
|
||||||
|
// Verify the requester's Ed25519 signature against their registered key.
|
||||||
|
const [identity] = await db
|
||||||
|
.select({ signingPublicKey: userIdentityKeys.signingPublicKey })
|
||||||
|
.from(userIdentityKeys)
|
||||||
|
.where(eq(userIdentityKeys.userId, session.user.id))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!identity) {
|
||||||
|
return context.json({ error: "Requester has no registered identity key." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
let sigValid = false;
|
||||||
|
try {
|
||||||
|
const publicKey = base58_to_binary(identity.signingPublicKey);
|
||||||
|
const sigBytes = Uint8Array.from(Buffer.from(signature, "base64"));
|
||||||
|
const msg = canonicalFollowRequestBytes({
|
||||||
|
followId, followerId: session.user.id, followingId: userId, createdAt,
|
||||||
|
federationUrl: process.env.BETTER_AUTH_URL!,
|
||||||
|
});
|
||||||
|
sigValid = nacl.sign.detached.verify(msg, sigBytes, publicKey);
|
||||||
|
} catch (err) {
|
||||||
|
debug("follow INSERT signature verification threw: %o", err);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!sigValid) {
|
||||||
|
return context.json({ error: "Invalid follow request signature." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
const ownUrl = process.env.BETTER_AUTH_URL!;
|
const ownUrl = process.env.BETTER_AUTH_URL!;
|
||||||
const isLocal = !federationUrl || federationUrl === ownUrl;
|
const isLocal = !federationUrl || federationUrl === ownUrl;
|
||||||
|
|
||||||
|
|
@ -72,12 +113,27 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
return context.json({ error: "User not found." }, { status: 404 });
|
return context.json({ error: "User not found." }, { status: 404 });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Reject if the target user has blocked the requester.
|
||||||
|
const [existingBlock] = await db
|
||||||
|
.select({ id: blocks.id })
|
||||||
|
.from(blocks)
|
||||||
|
.where(and(
|
||||||
|
eq(blocks.blockerId, userId),
|
||||||
|
eq(blocks.blockedUserId, session.user.id),
|
||||||
|
))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (existingBlock) {
|
||||||
|
return context.json({ error: "Unable to follow this user." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
const following = await db.insert(follows).values({
|
const following = await db.insert(follows).values({
|
||||||
id: crypto.randomUUID(),
|
id: followId,
|
||||||
followerId: session.user.id,
|
followerId: session.user.id,
|
||||||
followingId: userId,
|
followingId: userId,
|
||||||
accepted: !targetUser.isPrivate,
|
accepted: !targetUser.isPrivate,
|
||||||
createdAt: new Date(),
|
createdAt: new Date(createdAt),
|
||||||
|
requesterSignature: signature,
|
||||||
}).returning();
|
}).returning();
|
||||||
|
|
||||||
return context.json({ following }, { status: 200 });
|
return context.json({ following }, { status: 200 });
|
||||||
|
|
@ -115,12 +171,13 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
}
|
}
|
||||||
|
|
||||||
const following = await db.insert(follows).values({
|
const following = await db.insert(follows).values({
|
||||||
id: crypto.randomUUID(),
|
id: followId,
|
||||||
followerId: session.user.id,
|
followerId: session.user.id,
|
||||||
followingId: userId,
|
followingId: userId,
|
||||||
accepted: false,
|
accepted: false,
|
||||||
createdAt: new Date(),
|
createdAt: new Date(createdAt),
|
||||||
followerServerUrl: peerRegistryUrlOrNull(serverUrl),
|
followerServerUrl: peerRegistryUrlOrNull(serverUrl),
|
||||||
|
requesterSignature: signature,
|
||||||
}).returning();
|
}).returning();
|
||||||
|
|
||||||
const job = await db.insert(deliveryJobs).values({
|
const job = await db.insert(deliveryJobs).values({
|
||||||
|
|
@ -140,6 +197,73 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
|
|
||||||
return context.json({ following }, { status: 200 });
|
return context.json({ following }, { status: 200 });
|
||||||
}
|
}
|
||||||
|
case "RESPOND": {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) {
|
||||||
|
return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const { followId, response, timestamp, signature } = context.body;
|
||||||
|
|
||||||
|
// The responder must own the followingId on this follow row.
|
||||||
|
const [follow] = await db
|
||||||
|
.select({
|
||||||
|
id: follows.id,
|
||||||
|
followerId: follows.followerId,
|
||||||
|
followingId: follows.followingId,
|
||||||
|
responderSignature: follows.responderSignature,
|
||||||
|
})
|
||||||
|
.from(follows)
|
||||||
|
.where(eq(follows.id, followId))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!follow) {
|
||||||
|
return context.json({ error: "Follow request not found." }, { status: 404 });
|
||||||
|
}
|
||||||
|
|
||||||
|
if (follow.followingId !== session.user.id) {
|
||||||
|
return context.json({ error: "Only the target user can respond to this follow request." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
if (follow.responderSignature) {
|
||||||
|
return context.json({ error: "This follow request has already been responded to." }, { status: 409 });
|
||||||
|
}
|
||||||
|
|
||||||
|
// Verify the responder's signature.
|
||||||
|
const [identity] = await db
|
||||||
|
.select({ signingPublicKey: userIdentityKeys.signingPublicKey })
|
||||||
|
.from(userIdentityKeys)
|
||||||
|
.where(eq(userIdentityKeys.userId, session.user.id))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!identity) {
|
||||||
|
return context.json({ error: "Responder has no registered identity key." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
let sigValid = false;
|
||||||
|
try {
|
||||||
|
const publicKey = base58_to_binary(identity.signingPublicKey);
|
||||||
|
const sigBytes = Uint8Array.from(Buffer.from(signature, "base64"));
|
||||||
|
const msg = canonicalFollowResponseBytes({ followId, response, timestamp, federationUrl: process.env.BETTER_AUTH_URL! });
|
||||||
|
sigValid = nacl.sign.detached.verify(msg, sigBytes, publicKey);
|
||||||
|
} catch (err) {
|
||||||
|
debug("follow RESPOND signature verification threw: %o", err);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!sigValid) {
|
||||||
|
return context.json({ error: "Invalid follow response signature." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const accepted = response === "accept";
|
||||||
|
|
||||||
|
const [updated] = await db
|
||||||
|
.update(follows)
|
||||||
|
.set({ accepted, responderSignature: signature })
|
||||||
|
.where(eq(follows.id, followId))
|
||||||
|
.returning();
|
||||||
|
|
||||||
|
return context.json({ follow: updated }, { status: 200 });
|
||||||
|
}
|
||||||
case "FEDERATE": {
|
case "FEDERATE": {
|
||||||
const { payload, signature } = context.body;
|
const { payload, signature } = context.body;
|
||||||
|
|
||||||
|
|
@ -183,6 +307,20 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
}, { status: 404 });
|
}, { status: 404 });
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Reject if the local target user has blocked the remote follower.
|
||||||
|
const [federatedBlock] = await db
|
||||||
|
.select({ id: blocks.id })
|
||||||
|
.from(blocks)
|
||||||
|
.where(and(
|
||||||
|
eq(blocks.blockerId, following.followingId),
|
||||||
|
eq(blocks.blockedUserId, following.followerId),
|
||||||
|
))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (federatedBlock) {
|
||||||
|
return context.json({ error: "Unable to follow this user." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
const accepted = !targetUser.isPrivate;
|
const accepted = !targetUser.isPrivate;
|
||||||
|
|
||||||
await db.insert(follows).values({
|
await db.insert(follows).values({
|
||||||
|
|
@ -192,7 +330,7 @@ export const followUser = createAuthEndpoint("/social/follows", {
|
||||||
accepted,
|
accepted,
|
||||||
createdAt: new Date(),
|
createdAt: new Date(),
|
||||||
followingServerUrl: peerRegistryUrlOrNull(server.url),
|
followingServerUrl: peerRegistryUrlOrNull(server.url),
|
||||||
});
|
}).onConflictDoNothing();
|
||||||
|
|
||||||
return context.json({ status: "acknowledged", accepted }, { status: 200 });
|
return context.json({ status: "acknowledged", accepted }, { status: 200 });
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,18 +1,85 @@
|
||||||
import { createAuthEndpoint } from "better-auth/api"
|
import db from "@/lib/db";
|
||||||
import { z } from "zod"
|
import { mutes } from "@/lib/db/schema";
|
||||||
|
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
||||||
|
import { and, eq } from "drizzle-orm";
|
||||||
|
import { z } from "zod";
|
||||||
|
|
||||||
export const createMute = createAuthEndpoint("/social/mutes", {
|
export const createMute = createAuthEndpoint("/social/mutes", {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
}, async (context) => { })
|
body: z.object({
|
||||||
|
userId: z.string().min(1),
|
||||||
|
}),
|
||||||
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const { userId: mutedUserId } = context.body;
|
||||||
|
|
||||||
|
if (mutedUserId === session.user.id) {
|
||||||
|
return context.json({ error: "You cannot mute yourself." }, { status: 400 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const [existing] = await db
|
||||||
|
.select({ id: mutes.id })
|
||||||
|
.from(mutes)
|
||||||
|
.where(and(eq(mutes.userId, session.user.id), eq(mutes.mutedUserId, mutedUserId)))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (existing) {
|
||||||
|
return context.json({ error: "User is already muted." }, { status: 409 });
|
||||||
|
}
|
||||||
|
|
||||||
|
const [mute] = await db
|
||||||
|
.insert(mutes)
|
||||||
|
.values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
userId: session.user.id,
|
||||||
|
mutedUserId,
|
||||||
|
createdAt: new Date(),
|
||||||
|
})
|
||||||
|
.returning();
|
||||||
|
|
||||||
|
return context.json({ mute }, { status: 201 });
|
||||||
|
});
|
||||||
|
|
||||||
export const deleteMute = createAuthEndpoint("/social/mutes/:id", {
|
export const deleteMute = createAuthEndpoint("/social/mutes/:id", {
|
||||||
method: "DELETE",
|
method: "DELETE",
|
||||||
params: z.object({
|
params: z.object({
|
||||||
id: z.string(),
|
id: z.string(),
|
||||||
}),
|
}),
|
||||||
}, async (context) => { })
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const { id } = context.params;
|
||||||
|
|
||||||
|
const [mute] = await db
|
||||||
|
.select({ id: mutes.id, userId: mutes.userId })
|
||||||
|
.from(mutes)
|
||||||
|
.where(eq(mutes.id, id))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!mute) return context.json({ error: "Mute not found." }, { status: 404 });
|
||||||
|
|
||||||
|
if (mute.userId !== session.user.id) {
|
||||||
|
return context.json({ error: "Forbidden." }, { status: 403 });
|
||||||
|
}
|
||||||
|
|
||||||
|
await db.delete(mutes).where(eq(mutes.id, id));
|
||||||
|
|
||||||
|
return context.json({ success: true }, { status: 200 });
|
||||||
|
});
|
||||||
|
|
||||||
export const getMutes = createAuthEndpoint("/social/mutes", {
|
export const getMutes = createAuthEndpoint("/social/mutes", {
|
||||||
method: "GET",
|
method: "GET",
|
||||||
}, async (context) => { })
|
}, async (context) => {
|
||||||
|
const session = await getSessionFromCtx(context);
|
||||||
|
if (!session) return context.json({ error: "Unauthorized" }, { status: 401 });
|
||||||
|
|
||||||
|
const userMutes = await db
|
||||||
|
.select()
|
||||||
|
.from(mutes)
|
||||||
|
.where(eq(mutes.userId, session.user.id));
|
||||||
|
|
||||||
|
return context.json({ mutes: userMutes }, { status: 200 });
|
||||||
|
});
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,12 @@
|
||||||
import { getFederationQueue, type FederationDeliveryJob } from "@/lib/bull";
|
import { getFederationQueue, type FederationDeliveryJob } from "@/lib/bull";
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { deliveryJobs, follows, posts, serverRegistry, userIdentityKeys } from "@/lib/db/schema";
|
import { deliveryJobs, follows, posts, serverRegistry, userIdentityKeys } from "@/lib/db/schema";
|
||||||
import { encryptPayload } from "@/lib/federation/keytools";
|
import { base58_to_binary, encryptPayload } from "@/lib/federation/keytools";
|
||||||
import { applyFederatedPostInTransaction } from "@/lib/federation/proxy-helpers/federated-post";
|
import { applyFederatedPostInTransaction } from "@/lib/federation/proxy-helpers/federated-post";
|
||||||
import { canonicalPostBytes } from "@/lib/identity/postSignature";
|
import { canonicalPostBytes } from "@/lib/identity/postSignature";
|
||||||
import minioClient from "@/lib/plugins/storage/server/minio.client";
|
import minioClient from "@/lib/plugins/storage/server/minio.client";
|
||||||
import { EncryptedEnvelopeBaseSchema } from "@/lib/zod/EncryptedEnvelope";
|
import { EncryptedEnvelopeBaseSchema } from "@/lib/zod/EncryptedEnvelope";
|
||||||
import { PostEnvelopeSchema } from "@/lib/zod/methods/PostFederationSchema";
|
import { PostEnvelopeSchema } from "@/lib/zod/methods/PostFederationSchema";
|
||||||
import { base58_to_binary } from "base58-js";
|
|
||||||
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
import { createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
|
||||||
import createDebug from "debug";
|
import createDebug from "debug";
|
||||||
import { and, eq } from "drizzle-orm";
|
import { and, eq } from "drizzle-orm";
|
||||||
|
|
@ -117,12 +116,7 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
try {
|
try {
|
||||||
const publicKey = base58_to_binary(identity.signingPublicKey);
|
const publicKey = base58_to_binary(identity.signingPublicKey);
|
||||||
const signatureBytes = Uint8Array.from(Buffer.from(signature, "base64"));
|
const signatureBytes = Uint8Array.from(Buffer.from(signature, "base64"));
|
||||||
const message = canonicalPostBytes({
|
const message = canonicalPostBytes({ postId, authorId: user.user.id, publishedAt, content, federationUrl: process.env.BETTER_AUTH_URL! });
|
||||||
postId,
|
|
||||||
authorId: user.user.id,
|
|
||||||
publishedAt,
|
|
||||||
content,
|
|
||||||
});
|
|
||||||
signatureValid = nacl.sign.detached.verify(message, signatureBytes, publicKey);
|
signatureValid = nacl.sign.detached.verify(message, signatureBytes, publicKey);
|
||||||
} catch (err) {
|
} catch (err) {
|
||||||
debug("signature verification threw: %o", err);
|
debug("signature verification threw: %o", err);
|
||||||
|
|
@ -136,11 +130,8 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
}
|
}
|
||||||
|
|
||||||
const isPrivate = user.user.isPrivate;
|
const isPrivate = user.user.isPrivate;
|
||||||
const shouldPropagate = {
|
const policy = user.user.postPropagationPolicy as "all" | "followers" | "none";
|
||||||
all: true,
|
const shouldFederate = policy !== "none";
|
||||||
followers: isPrivate,
|
|
||||||
none: false,
|
|
||||||
}[user.user.postPropagationPolicy as "all" | "followers" | "none"] ?? true;
|
|
||||||
|
|
||||||
const published = new Date(publishedAt);
|
const published = new Date(publishedAt);
|
||||||
const inserted = await db
|
const inserted = await db
|
||||||
|
|
@ -150,7 +141,7 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
content,
|
content,
|
||||||
authorId: user.user.id,
|
authorId: user.user.id,
|
||||||
published,
|
published,
|
||||||
isLocal: shouldPropagate,
|
isLocal: true,
|
||||||
isPrivate,
|
isPrivate,
|
||||||
federationUrl: process.env.BETTER_AUTH_URL!,
|
federationUrl: process.env.BETTER_AUTH_URL!,
|
||||||
federationPostId: postId,
|
federationPostId: postId,
|
||||||
|
|
@ -161,7 +152,7 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
|
|
||||||
let federationDeliveriesQueued = 0;
|
let federationDeliveriesQueued = 0;
|
||||||
|
|
||||||
if (shouldPropagate) {
|
if (shouldFederate) {
|
||||||
const followers = await db
|
const followers = await db
|
||||||
.select()
|
.select()
|
||||||
.from(follows)
|
.from(follows)
|
||||||
|
|
@ -174,10 +165,18 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
debug("followers: %o", followers);
|
debug("followers: %o", followers);
|
||||||
debug("following: %o", following);
|
debug("following: %o", following);
|
||||||
|
|
||||||
|
if (followers.length === 0 || following.length === 0) {
|
||||||
|
debug("User has no followers and does not follow anyone, skipping federation");
|
||||||
|
return context.json(
|
||||||
|
{ id: inserted[0].id, federationDeliveriesQueued: 0 },
|
||||||
|
{ status: 200 },
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
const uniqueUrls = [
|
const uniqueUrls = [
|
||||||
...new Set([
|
...new Set([
|
||||||
...followers.map((f) => f.followingServerUrl).filter(Boolean),
|
...followers.map((f) => f.followerServerUrl).filter(Boolean),
|
||||||
...following.map((f) => f.followerServerUrl).filter(Boolean),
|
...following.map((f) => f.followingServerUrl).filter(Boolean),
|
||||||
]),
|
]),
|
||||||
] as string[];
|
] as string[];
|
||||||
|
|
||||||
|
|
@ -199,7 +198,6 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
const jobRows = uniqueUrls.map((url) => ({
|
const jobRows = uniqueUrls.map((url) => ({
|
||||||
id: crypto.randomUUID(),
|
id: crypto.randomUUID(),
|
||||||
targetUrl: url + "/api/auth/social/posts",
|
targetUrl: url + "/api/auth/social/posts",
|
||||||
serverUrl: url,
|
|
||||||
payload: jobPayload,
|
payload: jobPayload,
|
||||||
attempts: 0,
|
attempts: 0,
|
||||||
createdAt: new Date(),
|
createdAt: new Date(),
|
||||||
|
|
@ -213,7 +211,7 @@ export const createPost = createAuthEndpoint("/social/posts", {
|
||||||
data: {
|
data: {
|
||||||
deliveryJobId: row.id,
|
deliveryJobId: row.id,
|
||||||
targetUrl: row.targetUrl,
|
targetUrl: row.targetUrl,
|
||||||
serverUrl: row.serverUrl,
|
serverUrl: new URL(row.targetUrl).origin,
|
||||||
payload: row.payload,
|
payload: row.payload,
|
||||||
} satisfies FederationDeliveryJob,
|
} satisfies FederationDeliveryJob,
|
||||||
})),
|
})),
|
||||||
|
|
@ -268,8 +266,15 @@ export const uploadFile = createAuthEndpoint("/social/posts/files", {
|
||||||
PRESIGN_EXPIRY_SECONDS,
|
PRESIGN_EXPIRY_SECONDS,
|
||||||
);
|
);
|
||||||
|
|
||||||
const protocol = process.env.MINIO_USE_SSL === "true" ? "https" : "http";
|
// Use a presigned GET URL (1-year expiry) instead of a permanent direct object URL.
|
||||||
const objectUrl = `${protocol}://${process.env.MINIO_ENDPOINT}:${process.env.MINIO_PORT}/${process.env.MINIO_BUCKET}/${objectKey}`;
|
// This avoids leaking the MinIO origin/credentials to federation peers and preserves
|
||||||
|
// the ability to revoke access by invalidating the key.
|
||||||
|
const GET_EXPIRY_SECONDS = 365 * 24 * 60 * 60; // 1 year
|
||||||
|
const objectUrl = await minioClient.presignedGetObject(
|
||||||
|
process.env.MINIO_BUCKET!,
|
||||||
|
objectKey,
|
||||||
|
GET_EXPIRY_SECONDS,
|
||||||
|
);
|
||||||
|
|
||||||
return context.json({ presignedUrl, objectUrl, objectKey }, { status: 200 });
|
return context.json({ presignedUrl, objectUrl, objectKey }, { status: 200 });
|
||||||
});
|
});
|
||||||
|
|
|
||||||
|
|
@ -175,6 +175,26 @@ export default {
|
||||||
index: false,
|
index: false,
|
||||||
defaultValue: false,
|
defaultValue: false,
|
||||||
},
|
},
|
||||||
|
/**
|
||||||
|
* Base64-encoded Ed25519 detached signature from the follower.
|
||||||
|
* Covers the canonical follow-request payload (followId, followerId,
|
||||||
|
* followingId, createdAt) defined in followSignature.ts.
|
||||||
|
*/
|
||||||
|
requesterSignature: {
|
||||||
|
type: "string",
|
||||||
|
required: false,
|
||||||
|
index: false,
|
||||||
|
},
|
||||||
|
/**
|
||||||
|
* Base64-encoded Ed25519 detached signature from the target user.
|
||||||
|
* Covers the canonical follow-response payload (followId, response,
|
||||||
|
* timestamp). Set when the target accepts or rejects.
|
||||||
|
*/
|
||||||
|
responderSignature: {
|
||||||
|
type: "string",
|
||||||
|
required: false,
|
||||||
|
index: false,
|
||||||
|
},
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
deliveryJobs: {
|
deliveryJobs: {
|
||||||
|
|
|
||||||
64
src/lib/rate-limit/rate-limit-config.ts
Normal file
64
src/lib/rate-limit/rate-limit-config.ts
Normal file
|
|
@ -0,0 +1,64 @@
|
||||||
|
import type { RateLimitOptions } from "@/lib/rate-limit/rate-limit";
|
||||||
|
|
||||||
|
export interface RouteRateLimitConfig extends RateLimitOptions {
|
||||||
|
/**
|
||||||
|
* HTTP methods this rule applies to.
|
||||||
|
* Omit to apply to all methods.
|
||||||
|
*/
|
||||||
|
methods?: string[];
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Centralized rate-limit rules for all external-facing routes.
|
||||||
|
*
|
||||||
|
* Keys are exact URL pathnames (no query string).
|
||||||
|
* Each rule is enforced per-IP in the custom HTTP server before the
|
||||||
|
* request ever reaches a Next.js route handler.
|
||||||
|
*
|
||||||
|
* Limits are intentionally conservative — adjust as traffic patterns
|
||||||
|
* emerge in production.
|
||||||
|
*
|
||||||
|
* Federation endpoints (unauthenticated)
|
||||||
|
* /discover – server registration; 1 per 6 min/IP prevents spamming new entries
|
||||||
|
* /discover/rotate/init – key rotation kickoff; tight limit stops DoS / blacklist abuse
|
||||||
|
* /discover/rotate/confirm– challenge confirmation; tight limit stops brute-force
|
||||||
|
* /proxy – traffic relay; generous but bounded IP-level budget
|
||||||
|
* (a per-origin limit is also enforced inside proxy/route.ts)
|
||||||
|
*
|
||||||
|
* Social endpoints (session-authenticated — rate limit is a backstop for spam/automation)
|
||||||
|
* /api/auth/social/posts – post creation
|
||||||
|
* /api/auth/social/follows– follow actions
|
||||||
|
*/
|
||||||
|
// Raised during automated tests so full suites are not blocked by per-IP windows.
|
||||||
|
// `process.env.NODE_ENV` would be replaced at compile time by Next.js, so we
|
||||||
|
// also accept `SIPHER_TEST_MODE` which the dockerized test cluster sets at
|
||||||
|
// runtime while keeping `NODE_ENV=development` (same trick used in `src/lib/auth.ts`).
|
||||||
|
const env = { ...process.env };
|
||||||
|
const isTestMode =
|
||||||
|
env.NODE_ENV === "test" || env.SIPHER_TEST_MODE === "true";
|
||||||
|
const RLM = isTestMode
|
||||||
|
? { discoverPost: 2000, rotate: 500, proxyPost: 10_000 }
|
||||||
|
: { discoverPost: 10, rotate: 5, proxyPost: 120 };
|
||||||
|
|
||||||
|
export const RATE_LIMIT_ROUTES: Record<string, RouteRateLimitConfig> = {
|
||||||
|
"/discover": {
|
||||||
|
methods: ["POST"],
|
||||||
|
limit: RLM.discoverPost,
|
||||||
|
windowSeconds: 3600,
|
||||||
|
},
|
||||||
|
"/discover/rotate/init": {
|
||||||
|
methods: ["POST"],
|
||||||
|
limit: RLM.rotate,
|
||||||
|
windowSeconds: 60,
|
||||||
|
},
|
||||||
|
"/discover/rotate/confirm": {
|
||||||
|
methods: ["POST"],
|
||||||
|
limit: RLM.rotate,
|
||||||
|
windowSeconds: 60,
|
||||||
|
},
|
||||||
|
"/proxy": {
|
||||||
|
methods: ["POST"],
|
||||||
|
limit: RLM.proxyPost,
|
||||||
|
windowSeconds: 60,
|
||||||
|
}
|
||||||
|
};
|
||||||
52
src/lib/rate-limit/rate-limit.ts
Normal file
52
src/lib/rate-limit/rate-limit.ts
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
import getRedisClient from "@/lib/redis";
|
||||||
|
|
||||||
|
export interface RateLimitOptions {
|
||||||
|
/** Maximum number of requests allowed in the window. */
|
||||||
|
limit: number;
|
||||||
|
/** Sliding window size, in seconds. */
|
||||||
|
windowSeconds: number;
|
||||||
|
}
|
||||||
|
|
||||||
|
export type RateLimitResult =
|
||||||
|
| { allowed: true; remaining: number }
|
||||||
|
| { allowed: false; retryAfter: number };
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sliding-window rate limiter backed by Redis sorted sets.
|
||||||
|
*
|
||||||
|
* Each call atomically:
|
||||||
|
* 1. Removes entries older than `now - windowSeconds`.
|
||||||
|
* 2. Adds the current timestamp as a new entry.
|
||||||
|
* 3. Reads the count.
|
||||||
|
* 4. Refreshes the key TTL.
|
||||||
|
*
|
||||||
|
* If the resulting count exceeds `limit`, the request is rejected.
|
||||||
|
* The key is namespaced as `rl:<identifier>` so callers control
|
||||||
|
* the scope (IP, IP+route, session id, …).
|
||||||
|
*/
|
||||||
|
export async function checkRateLimit(
|
||||||
|
identifier: string,
|
||||||
|
options: RateLimitOptions,
|
||||||
|
): Promise<RateLimitResult> {
|
||||||
|
const redis = getRedisClient();
|
||||||
|
const { limit, windowSeconds } = options;
|
||||||
|
const now = Date.now();
|
||||||
|
const windowStart = now - windowSeconds * 1000;
|
||||||
|
const key = `rl:${identifier}`;
|
||||||
|
const member = `${now}-${Math.random().toString(36).slice(2)}`;
|
||||||
|
|
||||||
|
const pipeline = redis.pipeline();
|
||||||
|
pipeline.zremrangebyscore(key, "-inf", windowStart);
|
||||||
|
pipeline.zadd(key, now, member);
|
||||||
|
pipeline.zcard(key);
|
||||||
|
pipeline.expire(key, windowSeconds + 1);
|
||||||
|
|
||||||
|
const results = await pipeline.exec();
|
||||||
|
const count = (results?.[2]?.[1] as number) ?? 0;
|
||||||
|
|
||||||
|
if (count > limit) {
|
||||||
|
return { allowed: false, retryAfter: windowSeconds };
|
||||||
|
}
|
||||||
|
|
||||||
|
return { allowed: true, remaining: limit - count };
|
||||||
|
}
|
||||||
|
|
@ -2,7 +2,7 @@ import Redis from "ioredis";
|
||||||
|
|
||||||
let redisClient: Redis | null = null;
|
let redisClient: Redis | null = null;
|
||||||
|
|
||||||
export function getRedisClient(): Redis {
|
function getRedisClient(): Redis {
|
||||||
if (!redisClient) {
|
if (!redisClient) {
|
||||||
redisClient = new Redis(process.env.REDIS_URL!);
|
redisClient = new Redis(process.env.REDIS_URL!);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -15,4 +15,3 @@ const FollowInnerPayloadSchema = z.object({
|
||||||
});
|
});
|
||||||
|
|
||||||
export const FollowEnvelopeSchema = createEncryptedEnvelopeSchema(FollowInnerPayloadSchema);
|
export const FollowEnvelopeSchema = createEncryptedEnvelopeSchema(FollowInnerPayloadSchema);
|
||||||
export default FollowInnerPayloadSchema;
|
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@ import { postContentSchema } from "@/lib/plugins/social/server/helpers/social";
|
||||||
import { z } from "zod";
|
import { z } from "zod";
|
||||||
import { createEncryptedEnvelopeSchema } from "../EncryptedEnvelope";
|
import { createEncryptedEnvelopeSchema } from "../EncryptedEnvelope";
|
||||||
|
|
||||||
export const PostInnerPayloadSchema = z.object({
|
const PostInnerPayloadSchema = z.object({
|
||||||
post: z.object({
|
post: z.object({
|
||||||
id: z.string(),
|
id: z.string(),
|
||||||
content: postContentSchema,
|
content: postContentSchema,
|
||||||
|
|
|
||||||
|
|
@ -4,13 +4,62 @@ import next from 'next'
|
||||||
import { Server } from 'socket.io'
|
import { Server } from 'socket.io'
|
||||||
|
|
||||||
config({ path: '.env.local' })
|
config({ path: '.env.local' })
|
||||||
|
|
||||||
const port = parseInt(process.env.PORT || '3000', 10)
|
const port = parseInt(process.env.PORT || '3000', 10)
|
||||||
const dev = process.env.NODE_ENV !== 'production'
|
const dev = process.env.NODE_ENV !== 'production'
|
||||||
const app = next({ dev })
|
const app = next({ dev })
|
||||||
const handle = app.getRequestHandler()
|
const handle = app.getRequestHandler()
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Rate-limit enforcement
|
||||||
|
// Imported lazily after app.prepare() so Redis is initialised in the same
|
||||||
|
// event-loop tick as the rest of the server setup.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
async function applyRateLimit(
|
||||||
|
req: IncomingMessage,
|
||||||
|
): Promise<{ retryAfter: number } | null> {
|
||||||
|
const { RATE_LIMIT_ROUTES } = await import('./lib/rate-limit/rate-limit-config')
|
||||||
|
const { checkRateLimit } = await import('./lib/rate-limit/rate-limit')
|
||||||
|
|
||||||
|
const pathname = (req.url ?? '/').split('?')[0]
|
||||||
|
const method = req.method?.toUpperCase() ?? 'GET'
|
||||||
|
|
||||||
|
const rule = RATE_LIMIT_ROUTES[pathname]
|
||||||
|
if (!rule) return null
|
||||||
|
if (rule.methods && !rule.methods.includes(method)) return null
|
||||||
|
|
||||||
|
const forwarded = req.headers['x-forwarded-for']
|
||||||
|
const ip =
|
||||||
|
(Array.isArray(forwarded) ? forwarded[0] : forwarded)
|
||||||
|
?.split(',')[0]
|
||||||
|
?.trim() ?? req.socket.remoteAddress ?? 'unknown'
|
||||||
|
|
||||||
|
const result = await checkRateLimit(`${pathname}:${ip}`, rule)
|
||||||
|
if (!result.allowed) return { retryAfter: result.retryAfter }
|
||||||
|
return null
|
||||||
|
}
|
||||||
|
|
||||||
app.prepare().then(async () => {
|
app.prepare().then(async () => {
|
||||||
const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {
|
const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {
|
||||||
|
try {
|
||||||
|
const limited = await applyRateLimit(req)
|
||||||
|
if (limited) {
|
||||||
|
const body = JSON.stringify({ error: 'Too many requests. Please try again later.' })
|
||||||
|
res.writeHead(429, {
|
||||||
|
'Content-Type': 'application/json',
|
||||||
|
'Retry-After': String(limited.retryAfter),
|
||||||
|
'Content-Length': Buffer.byteLength(body),
|
||||||
|
})
|
||||||
|
res.end(body)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
// Rate-limit failures are non-fatal — let the request through
|
||||||
|
// rather than blocking legitimate traffic due to a Redis hiccup.
|
||||||
|
console.error('[rate-limit] middleware error (passing through):', err)
|
||||||
|
}
|
||||||
|
|
||||||
handle(req, res)
|
handle(req, res)
|
||||||
})
|
})
|
||||||
|
|
||||||
|
|
@ -24,7 +73,6 @@ app.prepare().then(async () => {
|
||||||
server.listen(port)
|
server.listen(port)
|
||||||
|
|
||||||
console.log(
|
console.log(
|
||||||
`> Server listening at ${process.env.BETTER_AUTH_URL!} as ${dev ? 'development' : process.env.NODE_ENV
|
`> Server listening at ${process.env.BETTER_AUTH_URL!} as ${dev ? 'development' : process.env.NODE_ENV}`,
|
||||||
}`
|
|
||||||
)
|
)
|
||||||
})
|
})
|
||||||
25
tests/README.md
Normal file
25
tests/README.md
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
# Automated QA (`tests/`)
|
||||||
|
|
||||||
|
Playwright drives HTTP assertions against the app started by [`playwright.config.ts`](../playwright.config.ts) (`tsx src/server.ts`). Scripts assume `.env.local` provides Postgres, Redis (rate limiting), and federation key env vars.
|
||||||
|
|
||||||
|
## Layout
|
||||||
|
|
||||||
|
| Folder | Purpose |
|
||||||
|
| ------------------------------ | --------------------------------------------------------------------------------- |
|
||||||
|
| [`federation/`](federation/) | Discovery, key rotation, and cryptographic helpers exercised via HTTP / pure libs |
|
||||||
|
| [`proxy/`](proxy/) | `/proxy` TARGETED + PROXY validation, federation follow ingestion |
|
||||||
|
| [`integration/`](integration/) | **Manual** Bun scripts needing three live federation peers |
|
||||||
|
| [`helpers/`](helpers/) | DB fixtures, local `/discover` stub |
|
||||||
|
|
||||||
|
## Commands
|
||||||
|
|
||||||
|
- `npm test` — full Playwright suite under `tests/` (only `**/*.e2e.ts`; see [`playwright.config.ts`](../playwright.config.ts))
|
||||||
|
- `bun test` — [`bun:test`](https://bun.sh/docs/cli/test) files such as `**/*.test.ts` (for example federation **keytools** unit checks). Do **not** expect Playwright HTTP suites here — they live in `*.e2e.ts` on purpose.
|
||||||
|
- `npm run test:federation` — `tests/federation/**` (Playwright `*.e2e.ts` plus any Bun tests in that folder)
|
||||||
|
- `npm run test:proxy` — `tests/proxy/**`
|
||||||
|
- `npm run test:integration:post` / `test:integration:proxy-chain` — manual federation harnesses
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- **`BETTER_AUTH_URL`** must match the URL Playwright waits on (`webServer.url` in `playwright.config.ts`, typically `http://localhost:3000`). If the webServer step times out, fix this mismatch first.
|
||||||
|
- **`NODE_ENV=test`** relaxes **pathname-only** HTTP-server rate limits in [`src/lib/rate-limit/rate-limit-config.ts`](../src/lib/rate-limit/rate-limit-config.ts) so federation suites can issue many POSTs per hour without exhausting budgets.
|
||||||
|
|
@ -1,466 +0,0 @@
|
||||||
/**
|
|
||||||
* Attack-vector tests for the /discover federation routes.
|
|
||||||
*
|
|
||||||
* These tests verify that the security fixes are working correctly.
|
|
||||||
* Each describe block targets a vulnerability that was found during audit
|
|
||||||
* and has now been patched.
|
|
||||||
*
|
|
||||||
* @author Tocka
|
|
||||||
* These tests were generated by AI (Claude Opus 4.6).
|
|
||||||
* I did review it and made some changes but it's still mostly AI generated so take this with a grain of salt.
|
|
||||||
*
|
|
||||||
* The AI did expose some actual vulnerabilities so it's not all bad.
|
|
||||||
* After fixing the vulnerabilitie, the tests were updated to match the new behavior.
|
|
||||||
* -----
|
|
||||||
*/
|
|
||||||
import { encryptPayload, fingerprintKey } from "@/lib/federation/keytools"
|
|
||||||
import { expect, test } from "@playwright/test"
|
|
||||||
import http from "node:http"
|
|
||||||
import {
|
|
||||||
clearTables,
|
|
||||||
generateEnvKeyPair,
|
|
||||||
getBlacklistedServer,
|
|
||||||
getChallengesByServerUrl,
|
|
||||||
seedChallenge,
|
|
||||||
seedServer,
|
|
||||||
} from "./helpers/db"
|
|
||||||
|
|
||||||
const BASE = "http://localhost:3000"
|
|
||||||
|
|
||||||
function getOwnEncryptionPublicKey(): Uint8Array {
|
|
||||||
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"))
|
|
||||||
}
|
|
||||||
|
|
||||||
function buildBadEnvelope() {
|
|
||||||
return encryptPayload(
|
|
||||||
JSON.stringify({
|
|
||||||
signingOldSignature: "wrong",
|
|
||||||
signingNewSignature: "wrong",
|
|
||||||
encryptionOldPlaintext: "wrong",
|
|
||||||
encryptionNewPlaintext: "wrong",
|
|
||||||
}),
|
|
||||||
getOwnEncryptionPublicKey(),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
function createTrapServer(fakePublicKey: string, fakeEncryptionPublicKey: string) {
|
|
||||||
const hits: { method: string; url: string }[] = []
|
|
||||||
const server = http.createServer((req, res) => {
|
|
||||||
hits.push({ method: req.method!, url: req.url! })
|
|
||||||
res.writeHead(200, { "Content-Type": "application/json" })
|
|
||||||
res.end(JSON.stringify({ publicKey: fakePublicKey, encryptionPublicKey: fakeEncryptionPublicKey }))
|
|
||||||
})
|
|
||||||
|
|
||||||
return {
|
|
||||||
hits,
|
|
||||||
start: () => new Promise<number>((resolve) => {
|
|
||||||
server.listen(0, "127.0.0.1", () => {
|
|
||||||
resolve((server.address() as { port: number }).port)
|
|
||||||
})
|
|
||||||
}),
|
|
||||||
stop: () => new Promise<void>((resolve) => { server.close(() => resolve()) }),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
test.beforeEach(async () => { await clearTables() })
|
|
||||||
test.afterEach(async () => { await clearTables() })
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 1. SSRF Protection — internal URLs are now blocked
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("SSRF protection", () => {
|
|
||||||
test("REGISTER rejects loopback URLs", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
const trap = createTrapServer(keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
const port = await trap.start()
|
|
||||||
|
|
||||||
try {
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "REGISTER",
|
|
||||||
url: `http://127.0.0.1:${port}`,
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.error).toMatch(/blocked/i)
|
|
||||||
|
|
||||||
expect(trap.hits.length).toBe(0)
|
|
||||||
} finally {
|
|
||||||
await trap.stop()
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
test("REGISTER rejects RFC-1918 and link-local URLs", async ({ request }) => {
|
|
||||||
const internalUrls = [
|
|
||||||
"http://10.0.0.1:8080",
|
|
||||||
"http://192.168.1.1:8080",
|
|
||||||
"http://169.254.169.254",
|
|
||||||
]
|
|
||||||
|
|
||||||
for (const url of internalUrls) {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "REGISTER",
|
|
||||||
url,
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.error).toMatch(/blocked/i)
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
test("DISCOVER rejects stored internal URLs", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer("http://127.0.0.1:9999", keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const envelopePayload = JSON.stringify({
|
|
||||||
publicKeyFingerprint: fingerprintKey(keys.signingPublicKey),
|
|
||||||
encryptionPublicKeyFingerprint: fingerprintKey(keys.encryptionPublicKey),
|
|
||||||
url: "http://127.0.0.1:9999",
|
|
||||||
})
|
|
||||||
const envelope = encryptPayload(envelopePayload, getOwnEncryptionPublicKey())
|
|
||||||
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "DISCOVER",
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
envelope,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.error).toMatch(/blocked/i)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 2. Blacklist enforcement — blocks all federation routes
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("Blacklist enforcement (fixed)", () => {
|
|
||||||
async function blacklistServer(serverUrl: string, request: any) {
|
|
||||||
await seedChallenge({
|
|
||||||
serverUrl,
|
|
||||||
attemptsLeft: 1,
|
|
||||||
expiresAt: new Date(Date.now() + 1000 * 60 * 5),
|
|
||||||
})
|
|
||||||
|
|
||||||
// First attempt: mismatch, decrements to 0
|
|
||||||
await request.post(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
data: {
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
// Second attempt: attemptsLeft=0, triggers blacklist
|
|
||||||
await request.post(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
data: {
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
const bl = await getBlacklistedServer(serverUrl)
|
|
||||||
expect(bl).toBeDefined()
|
|
||||||
}
|
|
||||||
|
|
||||||
test("blacklisted server is rejected by rotate/init", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const serverUrl = "https://blacklisted-server.example"
|
|
||||||
await seedServer(serverUrl, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
await blacklistServer(serverUrl, request as any)
|
|
||||||
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
const initRes = await request.post(`${BASE}/discover/rotate/init`, {
|
|
||||||
data: {
|
|
||||||
url: serverUrl,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(initRes.status()).toBe(403)
|
|
||||||
const body = await initRes.json()
|
|
||||||
expect(body.error).toMatch(/blacklisted/i)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("blacklisted server is rejected by rotate/confirm", async ({ request }) => {
|
|
||||||
const serverUrl = "https://blacklisted-confirm.example"
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(serverUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
await blacklistServer(serverUrl, request as any)
|
|
||||||
|
|
||||||
const confirmRes = await request.post(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
data: {
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(confirmRes.status()).toBe(403)
|
|
||||||
const body = await confirmRes.json()
|
|
||||||
expect(body.error).toMatch(/blacklisted/i)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 3. Race condition fixed — transaction + FOR UPDATE
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("Race condition fixed on rotate/confirm", () => {
|
|
||||||
test("concurrent requests are serialised by the row lock", async () => {
|
|
||||||
const serverUrl = "https://race-target.example"
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(serverUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
await seedChallenge({
|
|
||||||
serverUrl,
|
|
||||||
attemptsLeft: 1,
|
|
||||||
expiresAt: new Date(Date.now() + 1000 * 60 * 5),
|
|
||||||
})
|
|
||||||
|
|
||||||
const payload = JSON.stringify({
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
})
|
|
||||||
|
|
||||||
const fire = () =>
|
|
||||||
fetch(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: payload,
|
|
||||||
})
|
|
||||||
|
|
||||||
const results = await Promise.all(Array.from({ length: 15 }, fire))
|
|
||||||
const statuses = results.map((r) => r.status)
|
|
||||||
|
|
||||||
const mismatch = statuses.filter((s) => s === 400).length
|
|
||||||
const blacklisted = statuses.filter((s) => s === 403).length
|
|
||||||
const notFound = statuses.filter((s) => s === 404).length
|
|
||||||
|
|
||||||
expect(mismatch).toBeLessThanOrEqual(1)
|
|
||||||
expect(mismatch + blacklisted + notFound).toBe(statuses.length)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 4. Challenge deduplication — no flooding, no attempt reset
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("Challenge deduplication (fixed)", () => {
|
|
||||||
test("second init is rejected while a challenge is pending", async ({ request }) => {
|
|
||||||
const serverUrl = "https://dedup-target.example"
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(serverUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const newKeys1 = generateEnvKeyPair()
|
|
||||||
const newKeys2 = generateEnvKeyPair()
|
|
||||||
|
|
||||||
const res1 = await request.post(`${BASE}/discover/rotate/init`, {
|
|
||||||
data: {
|
|
||||||
url: serverUrl,
|
|
||||||
newSigningPublicKey: newKeys1.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys1.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(res1.status()).toBe(200)
|
|
||||||
|
|
||||||
const res2 = await request.post(`${BASE}/discover/rotate/init`, {
|
|
||||||
data: {
|
|
||||||
url: serverUrl,
|
|
||||||
newSigningPublicKey: newKeys2.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys2.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(res2.status()).toBe(409)
|
|
||||||
const body = await res2.json()
|
|
||||||
expect(body.error).toMatch(/already pending/i)
|
|
||||||
|
|
||||||
const challenges = await getChallengesByServerUrl(serverUrl)
|
|
||||||
expect(challenges.length).toBe(1)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("init succeeds after the previous challenge expires", async ({ request }) => {
|
|
||||||
const serverUrl = "https://dedup-expire.example"
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(serverUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
await seedChallenge({
|
|
||||||
serverUrl,
|
|
||||||
expiresAt: new Date(Date.now() - 1000),
|
|
||||||
})
|
|
||||||
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
const res = await request.post(`${BASE}/discover/rotate/init`, {
|
|
||||||
data: {
|
|
||||||
url: serverUrl,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(200)
|
|
||||||
|
|
||||||
const challenges = await getChallengesByServerUrl(serverUrl)
|
|
||||||
expect(challenges.length).toBe(1)
|
|
||||||
expect(challenges[0].newSigningPublicKey).toBe(newKeys.signingPublicKey)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("blacklisted server cannot reset attempts via new init", async ({ request }) => {
|
|
||||||
const serverUrl = "https://reset-blocked.example"
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(serverUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
await seedChallenge({
|
|
||||||
serverUrl,
|
|
||||||
attemptsLeft: 1,
|
|
||||||
expiresAt: new Date(Date.now() + 1000 * 60 * 5),
|
|
||||||
})
|
|
||||||
await request.post(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
data: {
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
},
|
|
||||||
})
|
|
||||||
await request.post(`${BASE}/discover/rotate/confirm`, {
|
|
||||||
data: {
|
|
||||||
serverUrl,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
const bl = await getBlacklistedServer(serverUrl)
|
|
||||||
expect(bl).toBeDefined()
|
|
||||||
|
|
||||||
const freshKeys = generateEnvKeyPair()
|
|
||||||
const initRes = await request.post(`${BASE}/discover/rotate/init`, {
|
|
||||||
data: {
|
|
||||||
url: serverUrl,
|
|
||||||
newSigningPublicKey: freshKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: freshKeys.encryptionPublicKey,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
expect(initRes.status()).toBe(403)
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 5. Envelope validation — field values must match the request
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("Envelope validation (fixed)", () => {
|
|
||||||
test("envelope with mismatched publicKey fingerprint is rejected", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer("https://sig-test.example", keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const badEnvelope = encryptPayload(
|
|
||||||
JSON.stringify({
|
|
||||||
publicKeyFingerprint: "wrong-fingerprint",
|
|
||||||
encryptionPublicKeyFingerprint: fingerprintKey(keys.encryptionPublicKey),
|
|
||||||
url: "https://sig-test.example",
|
|
||||||
}),
|
|
||||||
getOwnEncryptionPublicKey(),
|
|
||||||
)
|
|
||||||
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "DISCOVER",
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
envelope: badEnvelope,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("envelope with placeholder values is rejected", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer("https://sig-test2.example", keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const forgeryEnvelope = encryptPayload(
|
|
||||||
JSON.stringify({ publicKey: "x", url: "y" }),
|
|
||||||
getOwnEncryptionPublicKey(),
|
|
||||||
)
|
|
||||||
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "DISCOVER",
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
envelope: forgeryEnvelope,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("envelope with correct fingerprints passes validation", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
const trap = createTrapServer(keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
const port = await trap.start()
|
|
||||||
const peerUrl = `http://127.0.0.1:${port}`
|
|
||||||
|
|
||||||
try {
|
|
||||||
await seedServer(peerUrl, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const validEnvelope = encryptPayload(
|
|
||||||
JSON.stringify({
|
|
||||||
publicKeyFingerprint: fingerprintKey(keys.signingPublicKey),
|
|
||||||
encryptionPublicKeyFingerprint: fingerprintKey(keys.encryptionPublicKey),
|
|
||||||
url: peerUrl,
|
|
||||||
}),
|
|
||||||
getOwnEncryptionPublicKey(),
|
|
||||||
)
|
|
||||||
|
|
||||||
const res = await request.post(`${BASE}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "DISCOVER",
|
|
||||||
publicKey: keys.signingPublicKey,
|
|
||||||
encryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
envelope: validEnvelope,
|
|
||||||
},
|
|
||||||
})
|
|
||||||
|
|
||||||
// Envelope is valid, but the stored URL is internal → blocked by SSRF guard
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.error).toMatch(/blocked/i)
|
|
||||||
} finally {
|
|
||||||
await trap.stop()
|
|
||||||
}
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 6. Information disclosure: only url + isHealthy in peer list
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test.describe("Information disclosure", () => {
|
|
||||||
test("GET /discover only returns url and isHealthy for peers", async ({ request }) => {
|
|
||||||
const keys1 = generateEnvKeyPair()
|
|
||||||
const keys2 = generateEnvKeyPair()
|
|
||||||
await seedServer("https://peer-one.example", keys1.signingPublicKey, keys1.encryptionPublicKey)
|
|
||||||
await seedServer("https://peer-two.example", keys2.signingPublicKey, keys2.encryptionPublicKey)
|
|
||||||
|
|
||||||
const res = await request.get(`${BASE}/discover`)
|
|
||||||
expect(res.status()).toBe(200)
|
|
||||||
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.peers).toBeInstanceOf(Array)
|
|
||||||
expect(body.peers.length).toBeGreaterThanOrEqual(2)
|
|
||||||
|
|
||||||
for (const peer of body.peers) {
|
|
||||||
expect(peer.url).toBeDefined()
|
|
||||||
expect(peer.isHealthy).toBeDefined()
|
|
||||||
expect(peer.id).toBeUndefined()
|
|
||||||
expect(peer.createdAt).toBeUndefined()
|
|
||||||
expect(peer.updatedAt).toBeUndefined()
|
|
||||||
expect(peer.lastSeen).toBeUndefined()
|
|
||||||
}
|
|
||||||
})
|
|
||||||
})
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
|
|
||||||
// NOTICE: Does not work, will fix it later
|
|
||||||
|
|
||||||
// test("create and login user", async ({ context, page }) => {
|
|
||||||
// const ctx = await auth.$context
|
|
||||||
// const testUtils = ctx.test
|
|
||||||
|
|
||||||
// // Go to home page
|
|
||||||
// await page.goto("/")
|
|
||||||
// // Check if we are redirected to the auth page
|
|
||||||
// await expect(page).toHaveURL("/auth")
|
|
||||||
|
|
||||||
// // Create and save user
|
|
||||||
// const user = testUtils.createUser({
|
|
||||||
// email: "e2e@example.com",
|
|
||||||
// name: "E2E User"
|
|
||||||
// })
|
|
||||||
// await testUtils.saveUser(user)
|
|
||||||
|
|
||||||
// // Get cookies and inject into browser
|
|
||||||
// const cookies = await testUtils.getCookies({
|
|
||||||
// userId: user.id,
|
|
||||||
// domain: "localhost"
|
|
||||||
// })
|
|
||||||
// await context.addCookies(cookies)
|
|
||||||
|
|
||||||
// // Login
|
|
||||||
// await testUtils.login({ userId: user.id })
|
|
||||||
// // Check if we got redirected to the home page
|
|
||||||
// await expect(page).toHaveURL("/")
|
|
||||||
|
|
||||||
// // Check if we are logged in
|
|
||||||
// const headers = await testUtils.getAuthHeaders({ userId: user.id })
|
|
||||||
// expect(headers).toBeDefined()
|
|
||||||
// expect(headers.get("Authorization")).toBeDefined()
|
|
||||||
|
|
||||||
// // Delete user
|
|
||||||
// await testUtils.deleteUser(user.id)
|
|
||||||
|
|
||||||
// // Check if user is deleted
|
|
||||||
// const deletedUser = await ctx.internalAdapter.findUserById(user.id)
|
|
||||||
// expect(deletedUser).toBeNull()
|
|
||||||
// })
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
import { expect, test } from "@playwright/test";
|
|
||||||
import createDebug from "debug";
|
|
||||||
import { clearServerRegistry, getServerByUrl, insertServerEcho, } from "./helpers/db";
|
|
||||||
|
|
||||||
const debug = createDebug("test:discover");
|
|
||||||
|
|
||||||
const url = "http://172.21.157.201:3001";
|
|
||||||
const serverUrl = process.env.BETTER_AUTH_URL!;
|
|
||||||
if (!serverUrl) {
|
|
||||||
throw new Error("BETTER_AUTH_URL is not set");
|
|
||||||
}
|
|
||||||
|
|
||||||
test.beforeEach(async () => {
|
|
||||||
await clearServerRegistry()
|
|
||||||
})
|
|
||||||
test.afterEach(async () => {
|
|
||||||
await clearServerRegistry()
|
|
||||||
})
|
|
||||||
|
|
||||||
test("discover server", async ({ request, page }) => {
|
|
||||||
const response = await request.post(`${serverUrl}/discover`, {
|
|
||||||
data: {
|
|
||||||
method: "REGISTER",
|
|
||||||
url: new URL(url).toString(),
|
|
||||||
publicKey: process.env.FEDERATION_PUBLIC_KEY!,
|
|
||||||
encryptionPublicKey: process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
const status = response.status()
|
|
||||||
const body = await response.json();
|
|
||||||
debug("response status: %o", status);
|
|
||||||
debug("response body: %o", body);
|
|
||||||
expect(status).toBe(200)
|
|
||||||
expect(body).toMatchObject({ message: "Server registered successfully" })
|
|
||||||
expect(body.echo).toBeInstanceOf(Object)
|
|
||||||
|
|
||||||
await insertServerEcho(
|
|
||||||
serverUrl,
|
|
||||||
body.echo.publicKey as string,
|
|
||||||
body.echo.encryptionPublicKey as string,
|
|
||||||
);
|
|
||||||
|
|
||||||
const server = await getServerByUrl(serverUrl);
|
|
||||||
expect(server).toBeDefined()
|
|
||||||
expect(server?.publicKey).toBe(body.echo.publicKey as string)
|
|
||||||
});
|
|
||||||
242
tests/docker-compose.yml
Normal file
242
tests/docker-compose.yml
Normal file
|
|
@ -0,0 +1,242 @@
|
||||||
|
# ─────────────────────────────────────────────────────────────────────────────
|
||||||
|
# Sipher federation test cluster
|
||||||
|
#
|
||||||
|
# Three independent Sipher instances (A, B, C) sharing one Postgres server
|
||||||
|
# (separate databases) and one Redis server (separate logical DBs 0/1/2).
|
||||||
|
#
|
||||||
|
# All commands below should be run from the repository root with the explicit
|
||||||
|
# compose file (-f tests/docker-compose.yml) — `package.json` already wraps
|
||||||
|
# the common ones (docker:generate-keys, docker:build, docker:setup-discovery).
|
||||||
|
#
|
||||||
|
# Quick start
|
||||||
|
# ───────────
|
||||||
|
# 1. bun run docker:generate-keys # writes tests/docker/sipher-{a,b,c}.env
|
||||||
|
# 2. docker compose -f tests/docker-compose.yml \
|
||||||
|
# --profile init up # push DB schema (exits when done)
|
||||||
|
# 3. docker compose -f tests/docker-compose.yml up -d # start the cluster
|
||||||
|
# 4. docker compose -f tests/docker-compose.yml \
|
||||||
|
# --profile setup up # mutual discovery (exits when done)
|
||||||
|
#
|
||||||
|
# Running integration tests
|
||||||
|
# ─────────────────────────
|
||||||
|
# docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
# tests/integration/proxy-chain.ts \
|
||||||
|
# --proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
#
|
||||||
|
# docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
# tests/integration/federation-post-delivery.ts \
|
||||||
|
# --proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
#
|
||||||
|
# Both integration scripts now auto-create their own Better Auth users + identity
|
||||||
|
# keys + follow rows via HTTP, so you no longer need to pass --bearer.
|
||||||
|
#
|
||||||
|
# Teardown
|
||||||
|
# ────────
|
||||||
|
# docker compose -f tests/docker-compose.yml down # stop (keeps volumes)
|
||||||
|
# docker compose -f tests/docker-compose.yml down -v # stop + wipe all data volumes
|
||||||
|
# ─────────────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
# Pinned project name so the docker objects (containers, network, volumes) keep
|
||||||
|
# stable names regardless of the directory containing this compose file. Docker
|
||||||
|
# would otherwise default to the parent directory of the compose file.
|
||||||
|
name: sipher-noai
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
# ── Infrastructure ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
postgres:
|
||||||
|
image: postgres:16-alpine
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
POSTGRES_USER: sipher
|
||||||
|
POSTGRES_PASSWORD: sipher_test
|
||||||
|
# sipher_a is created by POSTGRES_DB; init.sql creates sipher_b + sipher_c.
|
||||||
|
POSTGRES_DB: sipher_a
|
||||||
|
volumes:
|
||||||
|
- ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
|
||||||
|
- postgres_data:/var/lib/postgresql/data
|
||||||
|
# No host port binding — containers reach Postgres over the Docker network.
|
||||||
|
# To connect from the host for debugging: docker compose exec postgres psql -U sipher sipher_a
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "pg_isready -U sipher -d sipher_a"]
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 12
|
||||||
|
|
||||||
|
redis:
|
||||||
|
image: redis:7-alpine
|
||||||
|
restart: unless-stopped
|
||||||
|
# noeviction: BullMQ requires keys to never be silently dropped.
|
||||||
|
command: redis-server --maxmemory-policy noeviction
|
||||||
|
volumes:
|
||||||
|
- redis_data:/data
|
||||||
|
# No host port binding — containers reach Redis over the Docker network.
|
||||||
|
# To connect from the host for debugging: docker compose exec redis redis-cli
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "redis-cli", "ping"]
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 12
|
||||||
|
|
||||||
|
# ── Migrations (profile: init) ───────────────────────────────────────────────
|
||||||
|
# Run once: docker compose -f tests/docker-compose.yml --profile init up
|
||||||
|
# Each service pushes the Drizzle schema to its database and exits.
|
||||||
|
|
||||||
|
migrate-a:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-a.env
|
||||||
|
command: ["bunx", "drizzle-kit", "push", "--force"]
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
profiles: [init]
|
||||||
|
restart: "no"
|
||||||
|
|
||||||
|
migrate-b:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-b.env
|
||||||
|
command: ["bunx", "drizzle-kit", "push", "--force"]
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
profiles: [init]
|
||||||
|
restart: "no"
|
||||||
|
|
||||||
|
migrate-c:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-c.env
|
||||||
|
command: ["bunx", "drizzle-kit", "push", "--force"]
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
profiles: [init]
|
||||||
|
restart: "no"
|
||||||
|
|
||||||
|
# ── Sipher instances ─────────────────────────────────────────────────────────
|
||||||
|
# Each instance:
|
||||||
|
# • has its own Postgres database (sipher_a / _b / _c)
|
||||||
|
# • has its own Redis logical DB (0 / 1 / 2) — isolates BullMQ queues and
|
||||||
|
# rate-limit buckets so instances don't interfere with each other
|
||||||
|
# • has a unique federation Ed25519 + X25519 keypair (generated by docker:generate-keys)
|
||||||
|
# • lists sipher-a/b/c in DEV_ALLOWED_HOSTNAMES so the SSRF url-guard allows
|
||||||
|
# outbound federation requests to the other instances over the Docker network
|
||||||
|
|
||||||
|
sipher-a:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-a.env
|
||||||
|
ports:
|
||||||
|
- "3000:3000"
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_healthy
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "curl -fs http://localhost:3000/discover > /dev/null"]
|
||||||
|
interval: 15s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 6
|
||||||
|
start_period: 30s
|
||||||
|
|
||||||
|
sipher-b:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-b.env
|
||||||
|
ports:
|
||||||
|
- "3001:3001"
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_healthy
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "curl -fs http://localhost:3001/discover > /dev/null"]
|
||||||
|
interval: 15s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 6
|
||||||
|
start_period: 30s
|
||||||
|
|
||||||
|
sipher-c:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-c.env
|
||||||
|
ports:
|
||||||
|
- "3002:3002"
|
||||||
|
depends_on:
|
||||||
|
postgres:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_healthy
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "curl -fs http://localhost:3002/discover > /dev/null"]
|
||||||
|
interval: 15s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 6
|
||||||
|
start_period: 30s
|
||||||
|
|
||||||
|
# ── Discovery setup (profile: setup) ────────────────────────────────────────
|
||||||
|
# Run once after `docker compose up -d` to register all instances with each other.
|
||||||
|
# Waits for all three sipher instances to pass their healthcheck before running.
|
||||||
|
|
||||||
|
setup-discovery:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-a.env
|
||||||
|
command: ["tests/docker/setup-discovery.ts"]
|
||||||
|
depends_on:
|
||||||
|
sipher-a:
|
||||||
|
condition: service_healthy
|
||||||
|
sipher-b:
|
||||||
|
condition: service_healthy
|
||||||
|
sipher-c:
|
||||||
|
condition: service_healthy
|
||||||
|
profiles: [setup]
|
||||||
|
restart: "no"
|
||||||
|
entrypoint: ["bun", "run"]
|
||||||
|
|
||||||
|
# ── Integration test runner (profile: test) ──────────────────────────────────
|
||||||
|
# Runs tests/integration scripts inside the Docker network so service names
|
||||||
|
# (sipher-a, sipher-b, sipher-c) resolve correctly.
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
# tests/integration/proxy-chain.ts \
|
||||||
|
# --proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
#
|
||||||
|
# The test runner uses Server A's env (DATABASE_URL → sipher_a, federation keys)
|
||||||
|
# because the integration scripts import @/lib/db and read those credentials.
|
||||||
|
|
||||||
|
test-runner:
|
||||||
|
build:
|
||||||
|
context: ..
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
env_file: docker/sipher-a.env
|
||||||
|
depends_on:
|
||||||
|
sipher-a:
|
||||||
|
condition: service_healthy
|
||||||
|
sipher-b:
|
||||||
|
condition: service_healthy
|
||||||
|
sipher-c:
|
||||||
|
condition: service_healthy
|
||||||
|
profiles: [test]
|
||||||
|
restart: "no"
|
||||||
|
entrypoint: ["bun", "run"]
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
postgres_data:
|
||||||
|
redis_data:
|
||||||
80
tests/docker/generate-keys.ts
Normal file
80
tests/docker/generate-keys.ts
Normal file
|
|
@ -0,0 +1,80 @@
|
||||||
|
/**
|
||||||
|
* Generates unique Ed25519 + X25519 federation keypairs AND a random
|
||||||
|
* BETTER_AUTH_SECRET for each Sipher instance, writing everything into
|
||||||
|
* tests/docker/sipher-{a,b,c}.env (created from *.env.example if not yet present).
|
||||||
|
*
|
||||||
|
* Usage:
|
||||||
|
* bun run docker:generate-keys
|
||||||
|
*
|
||||||
|
* Run this once before the first `docker compose up`. Re-running rotates all
|
||||||
|
* secrets — wipe the databases afterwards if you do that intentionally.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import { readFileSync, writeFileSync, existsSync } from "node:fs";
|
||||||
|
import { randomBytes } from "node:crypto";
|
||||||
|
import { join, dirname } from "node:path";
|
||||||
|
import { fileURLToPath } from "node:url";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
const DOCKER_DIR = dirname(fileURLToPath(import.meta.url));
|
||||||
|
|
||||||
|
function generateSecrets() {
|
||||||
|
const signing = nacl.sign.keyPair();
|
||||||
|
const encryption = nacl.box.keyPair();
|
||||||
|
return {
|
||||||
|
BETTER_AUTH_SECRET: randomBytes(32).toString("hex"),
|
||||||
|
FEDERATION_PUBLIC_KEY: Buffer.from(signing.publicKey).toString("base64"),
|
||||||
|
FEDERATION_PRIVATE_KEY: Buffer.from(signing.secretKey).toString("base64"),
|
||||||
|
FEDERATION_ENCRYPTION_PUBLIC_KEY: Buffer.from(encryption.publicKey).toString("base64"),
|
||||||
|
FEDERATION_ENCRYPTION_PRIVATE_KEY: Buffer.from(encryption.secretKey).toString("base64"),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Replace `KEY=<placeholder>` or `KEY=` lines in an env-file string.
|
||||||
|
* Matches both empty values and the CHANGE_ME_* placeholder values used in the
|
||||||
|
* example files so the script is idempotent on first run.
|
||||||
|
*/
|
||||||
|
function injectSecrets(content: string, secrets: ReturnType<typeof generateSecrets>): string {
|
||||||
|
let out = content;
|
||||||
|
for (const [k, v] of Object.entries(secrets)) {
|
||||||
|
out = out.replace(
|
||||||
|
new RegExp(`^(${k})=.*$`, "m"),
|
||||||
|
`$1=${v}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
return out;
|
||||||
|
}
|
||||||
|
|
||||||
|
const instances = ["a", "b", "c"] as const;
|
||||||
|
|
||||||
|
for (const id of instances) {
|
||||||
|
const examplePath = join(DOCKER_DIR, `sipher-${id}.env.example`);
|
||||||
|
const outPath = join(DOCKER_DIR, `sipher-${id}.env`);
|
||||||
|
|
||||||
|
const template = readFileSync(examplePath, "utf8");
|
||||||
|
|
||||||
|
// If the env file already exists, start from it so any other custom edits
|
||||||
|
// (e.g. EMAIL_*, MINIO_*) are preserved; otherwise seed from the template.
|
||||||
|
const base = existsSync(outPath) ? readFileSync(outPath, "utf8") : template;
|
||||||
|
|
||||||
|
const secrets = generateSecrets();
|
||||||
|
const content = injectSecrets(base, secrets);
|
||||||
|
|
||||||
|
writeFileSync(outPath, content, "utf8");
|
||||||
|
console.log(`✔ tests/docker/sipher-${id}.env`);
|
||||||
|
console.log(` BETTER_AUTH_SECRET: ${secrets.BETTER_AUTH_SECRET.slice(0, 8)}…`);
|
||||||
|
console.log(` signing key: ${secrets.FEDERATION_PUBLIC_KEY.slice(0, 12)}…`);
|
||||||
|
console.log(` encryption key: ${secrets.FEDERATION_ENCRYPTION_PUBLIC_KEY.slice(0, 12)}…`);
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log(`
|
||||||
|
Done. Next steps:
|
||||||
|
1. docker compose -f tests/docker-compose.yml --profile init up # push DB schema
|
||||||
|
2. docker compose -f tests/docker-compose.yml up -d # start cluster
|
||||||
|
3. docker compose -f tests/docker-compose.yml --profile setup up # mutual discovery
|
||||||
|
4. Run integration tests inside Docker:
|
||||||
|
docker compose -f tests/docker-compose.yml run --rm test-runner \\
|
||||||
|
tests/integration/proxy-chain.ts \\
|
||||||
|
--proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
`);
|
||||||
4
tests/docker/postgres/init.sql
Normal file
4
tests/docker/postgres/init.sql
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
-- Postgres init script: creates the extra two databases for sipher-b and sipher-c.
|
||||||
|
-- sipher_a is already created by the POSTGRES_DB env-var in docker-compose.yml.
|
||||||
|
CREATE DATABASE sipher_b;
|
||||||
|
CREATE DATABASE sipher_c;
|
||||||
115
tests/docker/setup-discovery.ts
Normal file
115
tests/docker/setup-discovery.ts
Normal file
|
|
@ -0,0 +1,115 @@
|
||||||
|
export {};
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets up mutual discovery between all three Sipher federation instances.
|
||||||
|
*
|
||||||
|
* Each instance must know about the others before integration tests can run.
|
||||||
|
* This script performs the minimum calls to achieve a full mesh:
|
||||||
|
*
|
||||||
|
* A → discover B (A stores B, B stores A via REGISTER callback)
|
||||||
|
* A → discover C (A stores C, C stores A)
|
||||||
|
* B → discover C (B stores C, C stores B)
|
||||||
|
*
|
||||||
|
* It does this by issuing REGISTER requests to each server for each of the
|
||||||
|
* other two, which is equivalent to what discoverAndRegister() does internally.
|
||||||
|
*
|
||||||
|
* Usage (from within the Docker network):
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm setup-discovery
|
||||||
|
* # or directly:
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm test-runner tests/docker/setup-discovery.ts
|
||||||
|
*
|
||||||
|
* URLs default to the three Docker service names but can be overridden:
|
||||||
|
* SIPHER_A_URL=http://sipher-a:3000 \
|
||||||
|
* SIPHER_B_URL=http://sipher-b:3001 \
|
||||||
|
* SIPHER_C_URL=http://sipher-c:3002 \
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm test-runner tests/docker/setup-discovery.ts
|
||||||
|
*/
|
||||||
|
|
||||||
|
const URLS = [
|
||||||
|
process.env.SIPHER_A_URL ?? "http://sipher-a:3000",
|
||||||
|
process.env.SIPHER_B_URL ?? "http://sipher-b:3001",
|
||||||
|
process.env.SIPHER_C_URL ?? "http://sipher-c:3002",
|
||||||
|
];
|
||||||
|
|
||||||
|
const TIMEOUT_MS = 15_000;
|
||||||
|
|
||||||
|
interface DiscoverResponse {
|
||||||
|
url: string;
|
||||||
|
publicKey: string;
|
||||||
|
encryptionPublicKey: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function fetchInfo(url: string): Promise<DiscoverResponse> {
|
||||||
|
const res = await fetch(`${url}/discover`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
|
||||||
|
if (!res.ok) throw new Error(`GET ${url}/discover returned ${res.status}`);
|
||||||
|
const body = await res.json() as DiscoverResponse;
|
||||||
|
if (!body.url || !body.publicKey || !body.encryptionPublicKey) {
|
||||||
|
throw new Error(`${url}/discover returned incomplete keys`);
|
||||||
|
}
|
||||||
|
return body;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function register(targetUrl: string, peer: DiscoverResponse) {
|
||||||
|
const res = await fetch(`${targetUrl}/discover`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: peer.url,
|
||||||
|
publicKey: peer.publicKey,
|
||||||
|
encryptionPublicKey: peer.encryptionPublicKey,
|
||||||
|
}),
|
||||||
|
signal: AbortSignal.timeout(TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
const body = await res.json().catch(() => ({}));
|
||||||
|
if (!res.ok) {
|
||||||
|
throw new Error(`REGISTER ${peer.url} on ${targetUrl} failed (${res.status}): ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
return body;
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Fetch all three instances ────────────────────────────────────────────────
|
||||||
|
|
||||||
|
console.log("Fetching instance keys…");
|
||||||
|
const infos = await Promise.all(URLS.map(fetchInfo));
|
||||||
|
|
||||||
|
for (const info of infos) {
|
||||||
|
console.log(` ${info.url} signing=${info.publicKey.slice(0, 12)}…`);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Register each instance with every other instance ────────────────────────
|
||||||
|
// 6 POST calls: for every ordered pair (A→B, A→C, B→A, B→C, C→A, C→B).
|
||||||
|
// When server X receives REGISTER from Y it fetches Y's /discover to validate,
|
||||||
|
// so each call also exercises the full handshake.
|
||||||
|
|
||||||
|
console.log("\nRegistering peers…");
|
||||||
|
|
||||||
|
let ok = 0;
|
||||||
|
let fail = 0;
|
||||||
|
|
||||||
|
for (let i = 0; i < infos.length; i++) {
|
||||||
|
for (let j = 0; j < infos.length; j++) {
|
||||||
|
if (i === j) continue;
|
||||||
|
const target = URLS[i];
|
||||||
|
const peer = infos[j];
|
||||||
|
try {
|
||||||
|
await register(target, peer);
|
||||||
|
console.log(` ✔ ${peer.url} → ${target}`);
|
||||||
|
ok++;
|
||||||
|
} catch (err) {
|
||||||
|
console.error(` ✘ ${peer.url} → ${target}: ${err instanceof Error ? err.message : err}`);
|
||||||
|
fail++;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Summary ──────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
console.log(`\n${ok} registration(s) succeeded, ${fail} failed.`);
|
||||||
|
|
||||||
|
if (fail > 0) {
|
||||||
|
console.error("Some registrations failed — check that all instances are healthy and reachable.");
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("Mutual discovery complete. All instances know each other.");
|
||||||
65
tests/docker/sipher-a.env.example
Normal file
65
tests/docker/sipher-a.env.example
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
# ── Server A (port 3000) ─────────────────────────────────────────────────────
|
||||||
|
# Copy this file to tests/docker/sipher-a.env, then run:
|
||||||
|
# bun run docker:generate-keys
|
||||||
|
# That will write unique federation keypairs into each tests/docker/sipher-*.env file.
|
||||||
|
|
||||||
|
NODE_ENV=development
|
||||||
|
PORT=3000
|
||||||
|
|
||||||
|
# Signals to auth.ts that this is the federation test cluster — disables the
|
||||||
|
# real EmailService construction without affecting Next.js dev/prod heuristics
|
||||||
|
# (Next.js statically rewrites process.env.NODE_ENV, which would otherwise
|
||||||
|
# defeat any NODE_ENV-based check at runtime).
|
||||||
|
SIPHER_TEST_MODE=true
|
||||||
|
|
||||||
|
# Public base URL as seen by OTHER federation peers inside the Docker network.
|
||||||
|
# Integration test scripts also run inside Docker on the same network, so this
|
||||||
|
# is always the right value; no host.docker.internal tricks needed.
|
||||||
|
BETTER_AUTH_URL=http://sipher-a:3000
|
||||||
|
|
||||||
|
# Must be unique per instance and kept secret in production.
|
||||||
|
BETTER_AUTH_SECRET=CHANGE_ME_SECRET_A
|
||||||
|
|
||||||
|
# Each instance gets its own Postgres database.
|
||||||
|
DATABASE_URL=postgresql://sipher:sipher_test@postgres:5432/sipher_a
|
||||||
|
|
||||||
|
# Each instance gets its own Redis logical DB so BullMQ queues don't cross-contaminate.
|
||||||
|
REDIS_URL=redis://redis:6379/0
|
||||||
|
|
||||||
|
# Allow federation fetches to other sipher-* service names (Docker internal DNS).
|
||||||
|
# The url-guard checks these by hostname before doing IP resolution, so this
|
||||||
|
# safely bypasses the private-IP block for intra-cluster traffic only.
|
||||||
|
#
|
||||||
|
# `sipher-unreachable.test` is intentionally non-existent — it passes the
|
||||||
|
# url-guard but fails DNS lookup, producing the DNS_BLOCKED federation error
|
||||||
|
# code which the threat model classifies as proxy-eligible. The failover
|
||||||
|
# integration test (tests/integration/proxy-chain.ts) uses this to force the
|
||||||
|
# real `federationFetch` proxy-fallback path without disrupting the live cluster.
|
||||||
|
DEV_ALLOWED_HOSTNAMES=sipher-a,sipher-b,sipher-c,sipher-unreachable.test
|
||||||
|
|
||||||
|
# Needed because Docker container IPs are in the 172.x private range.
|
||||||
|
FEDERATION_ALLOW_PRIVATE_URLS=true
|
||||||
|
|
||||||
|
DEBUG=app:*,test:*
|
||||||
|
|
||||||
|
# ── Email (not required for federation tests — leave empty to disable) ────────
|
||||||
|
EMAIL_HOST=
|
||||||
|
EMAIL_PORT=
|
||||||
|
EMAIL_SECURE=
|
||||||
|
EMAIL_USER=
|
||||||
|
EMAIL_PASSWORD=
|
||||||
|
|
||||||
|
# ── MinIO (not exercised by the federation tests, but minio.client.ts throws
|
||||||
|
# at import time if any of these are unset, so dummy values keep auth loadable)
|
||||||
|
MINIO_BUCKET=sipher-test
|
||||||
|
MINIO_ENDPOINT=minio.local
|
||||||
|
MINIO_PORT=9000
|
||||||
|
MINIO_USE_SSL=false
|
||||||
|
MINIO_ACCESS_KEY=test-access-key
|
||||||
|
MINIO_SECRET_KEY=test-secret-key
|
||||||
|
|
||||||
|
# ── Federation keys — filled in by: bun run docker:generate-keys ─────────────
|
||||||
|
FEDERATION_PUBLIC_KEY=
|
||||||
|
FEDERATION_PRIVATE_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PUBLIC_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PRIVATE_KEY=
|
||||||
60
tests/docker/sipher-b.env.example
Normal file
60
tests/docker/sipher-b.env.example
Normal file
|
|
@ -0,0 +1,60 @@
|
||||||
|
# ── Server B (port 3001) ─────────────────────────────────────────────────────
|
||||||
|
# Copy this file to tests/docker/sipher-b.env, then run:
|
||||||
|
# bun run docker:generate-keys
|
||||||
|
# That will write unique federation keypairs into each tests/docker/sipher-*.env file.
|
||||||
|
|
||||||
|
NODE_ENV=development
|
||||||
|
PORT=3001
|
||||||
|
|
||||||
|
# Signals to auth.ts that this is the federation test cluster — disables the
|
||||||
|
# real EmailService construction without affecting Next.js dev/prod heuristics
|
||||||
|
# (Next.js statically rewrites process.env.NODE_ENV, which would otherwise
|
||||||
|
# defeat any NODE_ENV-based check at runtime).
|
||||||
|
SIPHER_TEST_MODE=true
|
||||||
|
|
||||||
|
# Public base URL as seen by OTHER federation peers inside the Docker network.
|
||||||
|
# Integration test scripts also run inside Docker on the same network, so this
|
||||||
|
# is always the right value; no host.docker.internal tricks needed.
|
||||||
|
BETTER_AUTH_URL=http://sipher-b:3001
|
||||||
|
|
||||||
|
# Must be unique per instance and kept secret in production.
|
||||||
|
BETTER_AUTH_SECRET=CHANGE_ME_SECRET_B
|
||||||
|
|
||||||
|
# Each instance gets its own Postgres database.
|
||||||
|
DATABASE_URL=postgresql://sipher:sipher_test@postgres:5432/sipher_b
|
||||||
|
|
||||||
|
# Each instance gets its own Redis logical DB so BullMQ queues don't cross-contaminate.
|
||||||
|
REDIS_URL=redis://redis:6379/1
|
||||||
|
|
||||||
|
# Allow federation fetches to other sipher-* service names (Docker internal DNS).
|
||||||
|
# The url-guard checks these by hostname before doing IP resolution, so this
|
||||||
|
# safely bypasses the private-IP block for intra-cluster traffic only.
|
||||||
|
DEV_ALLOWED_HOSTNAMES=sipher-a,sipher-b,sipher-c
|
||||||
|
|
||||||
|
# Needed because Docker container IPs are in the 172.x private range.
|
||||||
|
FEDERATION_ALLOW_PRIVATE_URLS=true
|
||||||
|
|
||||||
|
DEBUG=app:*,test:*
|
||||||
|
|
||||||
|
# ── Email (not required for federation tests — leave empty to disable) ────────
|
||||||
|
EMAIL_HOST=
|
||||||
|
EMAIL_PORT=
|
||||||
|
EMAIL_SECURE=
|
||||||
|
EMAIL_USER=
|
||||||
|
EMAIL_PASSWORD=
|
||||||
|
|
||||||
|
# ── MinIO (not exercised by the federation tests, but minio.client.ts throws
|
||||||
|
# at import time if any of these are unset, so dummy values keep auth loadable)
|
||||||
|
MINIO_BUCKET=sipher-test
|
||||||
|
MINIO_ENDPOINT=minio.local
|
||||||
|
MINIO_PORT=9000
|
||||||
|
MINIO_USE_SSL=false
|
||||||
|
MINIO_ACCESS_KEY=test-access-key
|
||||||
|
MINIO_SECRET_KEY=test-secret-key
|
||||||
|
|
||||||
|
# ── Federation keys — filled in by: bun run docker:generate-keys ─────────────
|
||||||
|
FEDERATION_PUBLIC_KEY=
|
||||||
|
FEDERATION_PRIVATE_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PUBLIC_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PRIVATE_KEY=
|
||||||
|
|
||||||
60
tests/docker/sipher-c.env.example
Normal file
60
tests/docker/sipher-c.env.example
Normal file
|
|
@ -0,0 +1,60 @@
|
||||||
|
# ── Server C (port 3002) ─────────────────────────────────────────────────────
|
||||||
|
# Copy this file to tests/docker/sipher-c.env, then run:
|
||||||
|
# bun run docker:generate-keys
|
||||||
|
# That will write unique federation keypairs into each tests/docker/sipher-*.env file.
|
||||||
|
|
||||||
|
NODE_ENV=development
|
||||||
|
PORT=3002
|
||||||
|
|
||||||
|
# Signals to auth.ts that this is the federation test cluster — disables the
|
||||||
|
# real EmailService construction without affecting Next.js dev/prod heuristics
|
||||||
|
# (Next.js statically rewrites process.env.NODE_ENV, which would otherwise
|
||||||
|
# defeat any NODE_ENV-based check at runtime).
|
||||||
|
SIPHER_TEST_MODE=true
|
||||||
|
|
||||||
|
# Public base URL as seen by OTHER federation peers inside the Docker network.
|
||||||
|
# Integration test scripts also run inside Docker on the same network, so this
|
||||||
|
# is always the right value; no host.docker.internal tricks needed.
|
||||||
|
BETTER_AUTH_URL=http://sipher-c:3002
|
||||||
|
|
||||||
|
# Must be unique per instance and kept secret in production.
|
||||||
|
BETTER_AUTH_SECRET=CHANGE_ME_SECRET_C
|
||||||
|
|
||||||
|
# Each instance gets its own Postgres database.
|
||||||
|
DATABASE_URL=postgresql://sipher:sipher_test@postgres:5432/sipher_c
|
||||||
|
|
||||||
|
# Each instance gets its own Redis logical DB so BullMQ queues don't cross-contaminate.
|
||||||
|
REDIS_URL=redis://redis:6379/2
|
||||||
|
|
||||||
|
# Allow federation fetches to other sipher-* service names (Docker internal DNS).
|
||||||
|
# The url-guard checks these by hostname before doing IP resolution, so this
|
||||||
|
# safely bypasses the private-IP block for intra-cluster traffic only.
|
||||||
|
DEV_ALLOWED_HOSTNAMES=sipher-a,sipher-b,sipher-c
|
||||||
|
|
||||||
|
# Needed because Docker container IPs are in the 172.x private range.
|
||||||
|
FEDERATION_ALLOW_PRIVATE_URLS=true
|
||||||
|
|
||||||
|
DEBUG=app:*,test:*
|
||||||
|
|
||||||
|
# ── Email (not required for federation tests — leave empty to disable) ────────
|
||||||
|
EMAIL_HOST=
|
||||||
|
EMAIL_PORT=
|
||||||
|
EMAIL_SECURE=
|
||||||
|
EMAIL_USER=
|
||||||
|
EMAIL_PASSWORD=
|
||||||
|
|
||||||
|
# ── MinIO (not exercised by the federation tests, but minio.client.ts throws
|
||||||
|
# at import time if any of these are unset, so dummy values keep auth loadable)
|
||||||
|
MINIO_BUCKET=sipher-test
|
||||||
|
MINIO_ENDPOINT=minio.local
|
||||||
|
MINIO_PORT=9000
|
||||||
|
MINIO_USE_SSL=false
|
||||||
|
MINIO_ACCESS_KEY=test-access-key
|
||||||
|
MINIO_SECRET_KEY=test-secret-key
|
||||||
|
|
||||||
|
# ── Federation keys — filled in by: bun run docker:generate-keys ─────────────
|
||||||
|
FEDERATION_PUBLIC_KEY=
|
||||||
|
FEDERATION_PRIVATE_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PUBLIC_KEY=
|
||||||
|
FEDERATION_ENCRYPTION_PRIVATE_KEY=
|
||||||
|
|
||||||
22
tests/federation/README.md
Normal file
22
tests/federation/README.md
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
# Federation automated tests
|
||||||
|
|
||||||
|
HTTP suites use **`*.e2e.ts`** so `bun test` does not load them as Bun tests. Pure crypto checks live in **`keytools.test.ts`** (`bun:test`; run with `bun test`).
|
||||||
|
|
||||||
|
## Coverage
|
||||||
|
|
||||||
|
- **Key rotation** (`key-rotation.e2e.ts`): `/discover/rotate/init` and `/discover/rotate/confirm` validation, duplicate pending challenges, per-server URL rate limiting (`429`), blacklist rejection on init, exhausted confirmation attempts (**cancellation**, **no auto-blacklist**), malformed JSON envelopes without decrementing attempts, full rotate-and-clear lifecycle.
|
||||||
|
- **Keytools** (`keytools.test.ts`): `encryptPayload` / `decryptPayload`, signing primitives, fingerprint hashing — asserts cryptography rejects tampering instead of returning silent garbage.
|
||||||
|
|
||||||
|
`/discover` (GET, REGISTER, DISCOVER) coverage has moved to the docker integration suite at [`tests/integration/discover.ts`](../integration/discover.ts) — it runs against the real 3-instance federation cluster (`sipher-c` is the live peer in REGISTER / DISCOVER round-trips) with no stubs. Run with `bun run docker:test:discover`.
|
||||||
|
|
||||||
|
## Primary source files
|
||||||
|
|
||||||
|
- [`src/app/discover/rotate/init/route.ts`](../../src/app/discover/rotate/init/route.ts)
|
||||||
|
- [`src/app/discover/rotate/confirm/route.ts`](../../src/app/discover/rotate/confirm/route.ts)
|
||||||
|
- [`src/lib/federation/keytools.ts`](../../src/lib/federation/keytools.ts)
|
||||||
|
- [`src/lib/db/schema/index.ts`](../../src/lib/db/schema/index.ts) (`rotate_challenge_tokens`, `blacklisted_servers`)
|
||||||
|
- [`src/lib/rate-limit/rate-limit-config.ts`](../../src/lib/rate-limit/rate-limit-config.ts)
|
||||||
|
|
||||||
|
## Edge cases & limitations
|
||||||
|
|
||||||
|
- **Confirmation brute-force policy**: after repeated failures the challenge row is deleted and responses mention cancellation — servers are **not** automatically inserted into `blacklisted_servers` (prevents griefers from rotating-init spam to ban victims).
|
||||||
406
tests/federation/key-rotation.e2e.ts
Normal file
406
tests/federation/key-rotation.e2e.ts
Normal file
|
|
@ -0,0 +1,406 @@
|
||||||
|
/**
|
||||||
|
* Key rotation: /discover/rotate/init and /discover/rotate/confirm.
|
||||||
|
*
|
||||||
|
* Security note: confirm intentionally does **not** auto-blacklist the rotating
|
||||||
|
* server after failed proofs (that would let anyone spam-init for a victim URL and ban them).
|
||||||
|
*/
|
||||||
|
import db from "@/lib/db";
|
||||||
|
import { rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
||||||
|
import type { EncryptedEnvelope } from "@/lib/federation/keytools";
|
||||||
|
import { decryptPayload, encryptPayload, signMessage } from "@/lib/federation/keytools";
|
||||||
|
import { expect, test } from "@playwright/test";
|
||||||
|
import createDebug from "debug";
|
||||||
|
import { eq } from "drizzle-orm";
|
||||||
|
import {
|
||||||
|
clearTables,
|
||||||
|
generateEnvKeyPair,
|
||||||
|
getBlacklistedServer,
|
||||||
|
getChallengesByServerUrl,
|
||||||
|
getServerByUrl,
|
||||||
|
seedBlacklist,
|
||||||
|
seedChallenge,
|
||||||
|
seedServer,
|
||||||
|
} from "../helpers/db";
|
||||||
|
|
||||||
|
const debug = createDebug("test:key-rotation");
|
||||||
|
|
||||||
|
const SERVER_URL = "https://test-server.com";
|
||||||
|
|
||||||
|
test.beforeEach(async ({ }, testInfo) => {
|
||||||
|
debug("beforeEach – clearing tables for: %s", testInfo.title);
|
||||||
|
await clearTables();
|
||||||
|
});
|
||||||
|
test.afterEach(async ({ }, testInfo) => {
|
||||||
|
debug("afterEach – clearing tables after: %s", testInfo.title);
|
||||||
|
await clearTables();
|
||||||
|
});
|
||||||
|
|
||||||
|
function getOwnEncryptionPublicKey(): Uint8Array {
|
||||||
|
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"));
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildBadEnvelope() {
|
||||||
|
return encryptPayload(
|
||||||
|
JSON.stringify({
|
||||||
|
signingOldSignature: "wrong",
|
||||||
|
signingNewSignature: "wrong",
|
||||||
|
encryptionOldPlaintext: "wrong",
|
||||||
|
encryptionNewPlaintext: "wrong",
|
||||||
|
}),
|
||||||
|
getOwnEncryptionPublicKey(),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
interface InitChallenges {
|
||||||
|
signingOldChallenge: string;
|
||||||
|
signingNewChallenge: string;
|
||||||
|
encryptionOldChallenge: EncryptedEnvelope;
|
||||||
|
encryptionNewChallenge: EncryptedEnvelope;
|
||||||
|
}
|
||||||
|
|
||||||
|
function solveInitChallenges(
|
||||||
|
challenges: InitChallenges,
|
||||||
|
oldKeys: ReturnType<typeof generateEnvKeyPair>,
|
||||||
|
newKeys: ReturnType<typeof generateEnvKeyPair>,
|
||||||
|
) {
|
||||||
|
const oldSigningSecret = new Uint8Array(Buffer.from(oldKeys.signingSecretKey, "base64"));
|
||||||
|
const newSigningSecret = new Uint8Array(Buffer.from(newKeys.signingSecretKey, "base64"));
|
||||||
|
const oldEncSecret = new Uint8Array(Buffer.from(oldKeys.encryptionSecretKey, "base64"));
|
||||||
|
const newEncSecret = new Uint8Array(Buffer.from(newKeys.encryptionSecretKey, "base64"));
|
||||||
|
|
||||||
|
return {
|
||||||
|
signingOldSignature: signMessage(challenges.signingOldChallenge, oldSigningSecret),
|
||||||
|
signingNewSignature: signMessage(challenges.signingNewChallenge, newSigningSecret),
|
||||||
|
encryptionOldPlaintext: decryptPayload(challenges.encryptionOldChallenge, oldEncSecret),
|
||||||
|
encryptionNewPlaintext: decryptPayload(challenges.encryptionNewChallenge, newEncSecret),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
test("init rejects invalid JSON", async ({ request }) => {
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
data: "{",
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_JSON" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init rejects malformed body", async ({ request }) => {
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: "not-a-url",
|
||||||
|
newSigningPublicKey: "AA",
|
||||||
|
newEncryptionPublicKey: "BB",
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init rejects unregistered server", async ({ request }) => {
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: "https://unknown-server.com",
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init rejects when server URL is blacklisted", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedBlacklist(SERVER_URL);
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ error: /blacklisted/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init returns 429 after too many inits for same server URL (cleared challenges between)", async ({
|
||||||
|
request,
|
||||||
|
}) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const payload = {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
};
|
||||||
|
|
||||||
|
const r1 = await request.post("/discover/rotate/init", { data: payload });
|
||||||
|
expect(r1.status()).toBe(200);
|
||||||
|
|
||||||
|
await db.delete(rotateChallengeTokens).where(eq(rotateChallengeTokens.serverUrl, SERVER_URL));
|
||||||
|
|
||||||
|
const r2 = await request.post("/discover/rotate/init", { data: payload });
|
||||||
|
expect(r2.status()).toBe(200);
|
||||||
|
|
||||||
|
await db.delete(rotateChallengeTokens).where(eq(rotateChallengeTokens.serverUrl, SERVER_URL));
|
||||||
|
|
||||||
|
const r3 = await request.post("/discover/rotate/init", { data: payload });
|
||||||
|
expect(r3.status()).toBe(429);
|
||||||
|
expect(await r3.json()).toMatchObject({ error: /Too many rotation init attempts/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init rejects same keys as currently registered", async ({ request }) => {
|
||||||
|
const keys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, keys.signingPublicKey, keys.encryptionPublicKey);
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: keys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: keys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ error: /already registered/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init issues 4 challenges", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const res = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(200);
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
expect(body.signingOldChallenge).toBeDefined();
|
||||||
|
expect(body.signingNewChallenge).toBeDefined();
|
||||||
|
expect(body.encryptionOldChallenge).toBeDefined();
|
||||||
|
expect(body.encryptionOldChallenge.ephemeralPublicKey).toBeDefined();
|
||||||
|
expect(body.encryptionNewChallenge).toBeDefined();
|
||||||
|
expect(body.encryptionNewChallenge.ephemeralPublicKey).toBeDefined();
|
||||||
|
});
|
||||||
|
|
||||||
|
test("init rejects duplicate while challenge is pending", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys1 = generateEnvKeyPair();
|
||||||
|
const newKeys2 = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const res1 = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys1.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys1.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res1.status()).toBe(200);
|
||||||
|
|
||||||
|
const res2 = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys2.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys2.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res2.status()).toBe(409);
|
||||||
|
expect(await res2.json()).toMatchObject({ error: /already pending/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm rejects invalid JSON", async ({ request }) => {
|
||||||
|
const res = await request.post("/discover/rotate/confirm", {
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
data: "{",
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_JSON" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm rejects missing challenge", async ({ request }) => {
|
||||||
|
const res = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: "https://ghost-server.com",
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(404);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm rejects malformed envelope shape without touching attempts counter", async ({
|
||||||
|
request,
|
||||||
|
}) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const initRes = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(initRes.status()).toBe(200);
|
||||||
|
|
||||||
|
const res = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: {
|
||||||
|
ephemeralPublicKey: "AA",
|
||||||
|
iv: "AA",
|
||||||
|
ciphertext: "AA",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
|
||||||
|
const rows = await getChallengesByServerUrl(SERVER_URL);
|
||||||
|
expect(rows).toHaveLength(1);
|
||||||
|
expect(rows[0].attemptsLeft).toBe(3);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm rejects expired challenge", async ({ request }) => {
|
||||||
|
await seedChallenge({ expiresAt: new Date(Date.now() - 1000) });
|
||||||
|
const res = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ error: /expired/ });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm rejects wrong proofs (init → confirm)", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const initRes = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(initRes.status()).toBe(200);
|
||||||
|
|
||||||
|
const confirmRes = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(confirmRes.status()).toBe(400);
|
||||||
|
expect(await confirmRes.json()).toMatchObject({ error: /verification failed|attempt\(s\) left/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm cancels challenge after attempts exhausted (does NOT blacklist)", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const initRes = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(initRes.status()).toBe(200);
|
||||||
|
|
||||||
|
for (let i = 0; i < 3; i++) {
|
||||||
|
const res = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ error: /decrypt envelope|verification failed|attempt\(s\) left/i });
|
||||||
|
}
|
||||||
|
|
||||||
|
const finalRes = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(finalRes.status()).toBe(403);
|
||||||
|
expect(await finalRes.json()).toMatchObject({ error: /cancelled/i });
|
||||||
|
|
||||||
|
expect(await getBlacklistedServer(SERVER_URL)).toBeUndefined();
|
||||||
|
expect(await getChallengesByServerUrl(SERVER_URL)).toHaveLength(0);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("confirm returns 404 when registry row removed after init", async ({ request }) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const initRes = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(initRes.status()).toBe(200);
|
||||||
|
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, SERVER_URL));
|
||||||
|
|
||||||
|
const confirmRes = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope: buildBadEnvelope(),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(confirmRes.status()).toBe(404);
|
||||||
|
expect(await confirmRes.json()).toMatchObject({ error: /not found in registry/i });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("full rotation flow: init → solve → confirm rotates both keys and clears challenge", async ({
|
||||||
|
request,
|
||||||
|
}) => {
|
||||||
|
const oldKeys = generateEnvKeyPair();
|
||||||
|
const newKeys = generateEnvKeyPair();
|
||||||
|
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
const initRes = await request.post("/discover/rotate/init", {
|
||||||
|
data: {
|
||||||
|
url: SERVER_URL,
|
||||||
|
newSigningPublicKey: newKeys.signingPublicKey,
|
||||||
|
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(initRes.status()).toBe(200);
|
||||||
|
const challenges: InitChallenges = await initRes.json();
|
||||||
|
|
||||||
|
const proofs = solveInitChallenges(challenges, oldKeys, newKeys);
|
||||||
|
const envelope = encryptPayload(JSON.stringify(proofs), getOwnEncryptionPublicKey());
|
||||||
|
|
||||||
|
const confirmRes = await request.post("/discover/rotate/confirm", {
|
||||||
|
data: {
|
||||||
|
serverUrl: SERVER_URL,
|
||||||
|
envelope,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(confirmRes.status()).toBe(200);
|
||||||
|
expect(await confirmRes.json()).toMatchObject({ message: /confirmed/i });
|
||||||
|
|
||||||
|
const server = await getServerByUrl(SERVER_URL);
|
||||||
|
expect(server).toBeDefined();
|
||||||
|
expect(server!.publicKey).toBe(newKeys.signingPublicKey);
|
||||||
|
expect(server!.encryptionPublicKey).toBe(newKeys.encryptionPublicKey);
|
||||||
|
|
||||||
|
expect(await getChallengesByServerUrl(SERVER_URL)).toHaveLength(0);
|
||||||
|
});
|
||||||
73
tests/federation/keytools.test.ts
Normal file
73
tests/federation/keytools.test.ts
Normal file
|
|
@ -0,0 +1,73 @@
|
||||||
|
import type { EncryptedEnvelope } from "@/lib/federation/keytools";
|
||||||
|
import {
|
||||||
|
decryptPayload,
|
||||||
|
encryptPayload,
|
||||||
|
fingerprintKey,
|
||||||
|
signMessage,
|
||||||
|
verifySignature,
|
||||||
|
} from "@/lib/federation/keytools";
|
||||||
|
import { expect, test } from "bun:test";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
test("encryptPayload round-trips through decryptPayload for matching recipient keys", () => {
|
||||||
|
const recipient = nacl.box.keyPair();
|
||||||
|
const pub = new Uint8Array(recipient.publicKey);
|
||||||
|
const secret = new Uint8Array(recipient.secretKey);
|
||||||
|
const plaintext = JSON.stringify({ probe: true, n: 42 });
|
||||||
|
const env = encryptPayload(plaintext, pub);
|
||||||
|
expect(decryptPayload(env, secret)).toBe(plaintext);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("decryptPayload rejects tampered authTag", () => {
|
||||||
|
const recipient = nacl.box.keyPair();
|
||||||
|
const plaintext = "tamper-me";
|
||||||
|
const env = encryptPayload(plaintext, new Uint8Array(recipient.publicKey));
|
||||||
|
const tag = Buffer.from(env.authTag, "base64");
|
||||||
|
tag[0] ^= 0xff;
|
||||||
|
env.authTag = tag.toString("base64");
|
||||||
|
expect(() =>
|
||||||
|
decryptPayload(env, new Uint8Array(recipient.secretKey)),
|
||||||
|
).toThrow();
|
||||||
|
});
|
||||||
|
|
||||||
|
test("decryptPayload rejects wrong recipient secret key", () => {
|
||||||
|
const a = nacl.box.keyPair();
|
||||||
|
const b = nacl.box.keyPair();
|
||||||
|
const env = encryptPayload("secret", new Uint8Array(a.publicKey));
|
||||||
|
expect(() => decryptPayload(env, new Uint8Array(b.secretKey))).toThrow();
|
||||||
|
});
|
||||||
|
|
||||||
|
test("signMessage / verifySignature: happy path and tamper rejection", () => {
|
||||||
|
const signing = nacl.sign.keyPair();
|
||||||
|
const msg = 'canonical-message-bytes';
|
||||||
|
const sig = signMessage(msg, new Uint8Array(signing.secretKey));
|
||||||
|
expect(
|
||||||
|
verifySignature(msg, sig, new Uint8Array(signing.publicKey)),
|
||||||
|
).toBe(true);
|
||||||
|
|
||||||
|
expect(
|
||||||
|
verifySignature(msg + "x", sig, new Uint8Array(signing.publicKey)),
|
||||||
|
).toBe(false);
|
||||||
|
|
||||||
|
const other = nacl.sign.keyPair();
|
||||||
|
expect(
|
||||||
|
verifySignature(msg, sig, new Uint8Array(other.publicKey)),
|
||||||
|
).toBe(false);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("fingerprintKey is hex-stable across repeated calls", () => {
|
||||||
|
const b64 = Buffer.alloc(nacl.box.publicKeyLength, 9).toString("base64");
|
||||||
|
expect(fingerprintKey(b64)).toMatch(/^[0-9a-f]{64}$/);
|
||||||
|
expect(fingerprintKey(b64)).toBe(fingerprintKey(b64));
|
||||||
|
});
|
||||||
|
|
||||||
|
test("encryptPayload ciphertext mutation breaks decryption", () => {
|
||||||
|
const recipient = nacl.box.keyPair();
|
||||||
|
const env: EncryptedEnvelope = encryptPayload("payload", new Uint8Array(recipient.publicKey));
|
||||||
|
const ct = Buffer.from(env.ciphertext, "base64");
|
||||||
|
if (ct.length > 0) ct[0] ^= 1;
|
||||||
|
env.ciphertext = ct.toString("base64");
|
||||||
|
expect(() =>
|
||||||
|
decryptPayload(env, new Uint8Array(recipient.secretKey)),
|
||||||
|
).toThrow();
|
||||||
|
});
|
||||||
269
tests/helpers/auth-users.ts
Normal file
269
tests/helpers/auth-users.ts
Normal file
|
|
@ -0,0 +1,269 @@
|
||||||
|
/**
|
||||||
|
* HTTP-based helpers that create Better Auth users against a running Sipher
|
||||||
|
* instance (A, B, or C in the test cluster) and register the user-identity
|
||||||
|
* Ed25519 keys that the Oven and social plugins require for follows / posts.
|
||||||
|
*
|
||||||
|
* Test scripts running inside the Docker network call this helper instead of
|
||||||
|
* being passed `--bearer <token>` manually, so the entire integration
|
||||||
|
* suite can boot a fresh cluster, create its own users, sign and submit
|
||||||
|
* payloads, and shut everything down without hoomans in the loop.
|
||||||
|
*
|
||||||
|
* Returned `identity.signingPublicKey` matches the format expected by
|
||||||
|
* `/api/auth/oven/identity/register` and the follow/post signature verifiers
|
||||||
|
* (base58 of the raw 32-byte Ed25519 verification key). The fingerprint format
|
||||||
|
* mirrors `generateUserKeyPair` in `src/lib/federation/keytools.ts`:
|
||||||
|
* `base58(sha256(base64(publicKey)))`.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import { binary_to_base58 } from "@/lib/federation/keytools";
|
||||||
|
import { canonicalFollowRequestBytes } from "@/lib/identity/followSignature";
|
||||||
|
import { canonicalPostBytes } from "@/lib/identity/postSignature";
|
||||||
|
import { createHash, randomBytes } from "node:crypto";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
const FETCH_TIMEOUT_MS = 15_000;
|
||||||
|
|
||||||
|
interface IdentityKeyPair {
|
||||||
|
/** Base58 of the 32-byte Ed25519 verification key. */
|
||||||
|
signingPublicKey: string;
|
||||||
|
/** Raw 64-byte Ed25519 secret key (nacl form: seed || public). */
|
||||||
|
signingSecretKey: Uint8Array;
|
||||||
|
/** Base58 of sha256(base64(publicKey)). */
|
||||||
|
fingerprint: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface SipherTestUser {
|
||||||
|
instanceUrl: string;
|
||||||
|
userId: string;
|
||||||
|
email: string;
|
||||||
|
password: string;
|
||||||
|
username: string;
|
||||||
|
bearerToken: string;
|
||||||
|
identity: IdentityKeyPair;
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface CreateUserOptions {
|
||||||
|
emailPrefix?: string;
|
||||||
|
name?: string;
|
||||||
|
password?: string;
|
||||||
|
usernamePrefix?: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
function randomSuffix(len = 10): string {
|
||||||
|
return crypto.randomUUID().replace(/-/g, "").slice(0, len);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* The auth config has the `haveIBeenPwned()` plugin enabled, which rejects any
|
||||||
|
* password found in the HIBP breach database. A hex random gives 64+ bits of
|
||||||
|
* entropy in a small alphabet so the result is virtually guaranteed to be a
|
||||||
|
* miss — `T#` and `!2026` keep the upper / digit / symbol mix in case future
|
||||||
|
* password policy plugins are added.
|
||||||
|
*/
|
||||||
|
function strongRandomPassword(): string {
|
||||||
|
return `T#${randomBytes(24).toString("hex")}!2026`;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function readJsonSafe(res: Response): Promise<unknown> {
|
||||||
|
try {
|
||||||
|
return await res.json();
|
||||||
|
} catch {
|
||||||
|
try {
|
||||||
|
return await res.text();
|
||||||
|
} catch {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function generateUserIdentityKeyPair(): IdentityKeyPair {
|
||||||
|
const signing = nacl.sign.keyPair();
|
||||||
|
const signingPubB64 = Buffer.from(signing.publicKey).toString("base64");
|
||||||
|
const fingerprintBytes = createHash("sha256").update(signingPubB64).digest();
|
||||||
|
return {
|
||||||
|
signingPublicKey: binary_to_base58(signing.publicKey),
|
||||||
|
signingSecretKey: signing.secretKey,
|
||||||
|
fingerprint: binary_to_base58(new Uint8Array(fingerprintBytes)),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sign up + sign in + register identity in three sequential HTTP calls.
|
||||||
|
*
|
||||||
|
* Requires the target instance to expose:
|
||||||
|
* • Better Auth email/password (POST /api/auth/sign-up/email, /sign-in/email)
|
||||||
|
* • The `bearer()` plugin (returns `set-auth-token` on sign-in)
|
||||||
|
* • The Sipher Oven plugin (POST /api/auth/oven/identity/register)
|
||||||
|
*/
|
||||||
|
export async function createSipherUser(
|
||||||
|
instanceUrl: string,
|
||||||
|
opts: CreateUserOptions = {},
|
||||||
|
): Promise<SipherTestUser> {
|
||||||
|
const baseUrl = instanceUrl.replace(/\/$/, "");
|
||||||
|
const suffix = randomSuffix(10);
|
||||||
|
const email = `${opts.emailPrefix ?? "test"}-${suffix}@sipher.test`;
|
||||||
|
const name = opts.name ?? `Test User ${suffix}`;
|
||||||
|
const password = opts.password ?? strongRandomPassword();
|
||||||
|
const username = `${opts.usernamePrefix ?? "testuser"}_${suffix}`.toLowerCase();
|
||||||
|
|
||||||
|
// 1. Sign up — autoSignIn is false in this project's auth.ts, so the response
|
||||||
|
// has no session/token; we sign in below to get the bearer token.
|
||||||
|
const signUpRes = await fetch(`${baseUrl}/api/auth/sign-up/email`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({ email, password, name, username }),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
if (!signUpRes.ok) {
|
||||||
|
const body = await readJsonSafe(signUpRes);
|
||||||
|
throw new Error(`signUp on ${baseUrl} failed (${signUpRes.status}): ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
const signUpBody = (await readJsonSafe(signUpRes)) as { user?: { id?: string }; id?: string } | null;
|
||||||
|
const userId = signUpBody?.user?.id ?? signUpBody?.id;
|
||||||
|
if (!userId) {
|
||||||
|
throw new Error(`signUp on ${baseUrl} returned no user.id: ${JSON.stringify(signUpBody)}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. Sign in to obtain the bearer token.
|
||||||
|
const signInRes = await fetch(`${baseUrl}/api/auth/sign-in/email`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({ email, password }),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
if (!signInRes.ok) {
|
||||||
|
const body = await readJsonSafe(signInRes);
|
||||||
|
throw new Error(`signIn on ${baseUrl} failed (${signInRes.status}): ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
const bearerToken = signInRes.headers.get("set-auth-token");
|
||||||
|
if (!bearerToken) {
|
||||||
|
throw new Error(
|
||||||
|
`signIn on ${baseUrl} returned no \`set-auth-token\` header — is the bearer plugin enabled?`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
// Drain the body so the connection can be reused.
|
||||||
|
await readJsonSafe(signInRes);
|
||||||
|
|
||||||
|
// 3. Register the user's stable identity key.
|
||||||
|
const identity = generateUserIdentityKeyPair();
|
||||||
|
const registerRes = await fetch(`${baseUrl}/api/auth/oven/identity/register`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
Authorization: `Bearer ${bearerToken}`,
|
||||||
|
},
|
||||||
|
body: JSON.stringify({
|
||||||
|
signingPublicKey: identity.signingPublicKey,
|
||||||
|
fingerprint: identity.fingerprint,
|
||||||
|
}),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
if (!registerRes.ok) {
|
||||||
|
const body = await readJsonSafe(registerRes);
|
||||||
|
throw new Error(
|
||||||
|
`identity register on ${baseUrl} failed (${registerRes.status}): ${JSON.stringify(body)}`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
return { instanceUrl: baseUrl, userId, email, password, username, bearerToken, identity };
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Authenticated `POST /api/auth/social/follows` with `INSERT` method on `user`'s
|
||||||
|
* instance, signed with `user.identity.signingSecretKey`. The `followingUserId`
|
||||||
|
* is the user being followed; `targetFederationUrl` is the homeserver of that
|
||||||
|
* user (omit for a local follow).
|
||||||
|
*/
|
||||||
|
async function followUserOverHttp(
|
||||||
|
user: SipherTestUser,
|
||||||
|
params: { followingUserId: string; targetFederationUrl?: string },
|
||||||
|
): Promise<{ followId: string; raw: unknown }> {
|
||||||
|
const followId = crypto.randomUUID();
|
||||||
|
const createdAt = new Date().toISOString();
|
||||||
|
const federationUrl = params.targetFederationUrl ?? user.instanceUrl;
|
||||||
|
|
||||||
|
const msg = canonicalFollowRequestBytes({
|
||||||
|
followId,
|
||||||
|
followerId: user.userId,
|
||||||
|
followingId: params.followingUserId,
|
||||||
|
createdAt,
|
||||||
|
federationUrl: user.instanceUrl,
|
||||||
|
});
|
||||||
|
const sig = nacl.sign.detached(msg, user.identity.signingSecretKey);
|
||||||
|
const signature = Buffer.from(sig).toString("base64");
|
||||||
|
|
||||||
|
const body: Record<string, unknown> = {
|
||||||
|
method: "INSERT",
|
||||||
|
userId: params.followingUserId,
|
||||||
|
followId,
|
||||||
|
createdAt,
|
||||||
|
signature,
|
||||||
|
};
|
||||||
|
if (params.targetFederationUrl && params.targetFederationUrl !== user.instanceUrl) {
|
||||||
|
body.federationUrl = federationUrl;
|
||||||
|
}
|
||||||
|
|
||||||
|
const res = await fetch(`${user.instanceUrl}/api/auth/social/follows`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
Authorization: `Bearer ${user.bearerToken}`,
|
||||||
|
},
|
||||||
|
body: JSON.stringify(body),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
const json = await readJsonSafe(res);
|
||||||
|
if (!res.ok) {
|
||||||
|
throw new Error(`follow INSERT on ${user.instanceUrl} failed (${res.status}): ${JSON.stringify(json)}`);
|
||||||
|
}
|
||||||
|
return { followId, raw: json };
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface PostContentBlock {
|
||||||
|
type: "text" | "image" | "video" | "audio" | "link";
|
||||||
|
value?: string;
|
||||||
|
url?: string;
|
||||||
|
[k: string]: unknown;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Authenticated `POST /api/auth/social/posts` signed with the author's identity
|
||||||
|
* key. Returns the API response body (which includes `id` and
|
||||||
|
* `federationDeliveriesQueued`).
|
||||||
|
*/
|
||||||
|
export async function createPostOverHttp(
|
||||||
|
author: SipherTestUser,
|
||||||
|
content: PostContentBlock[],
|
||||||
|
): Promise<{ postId: string; federationDeliveriesQueued: number; raw: unknown }> {
|
||||||
|
const postId = crypto.randomUUID();
|
||||||
|
const publishedAt = new Date().toISOString();
|
||||||
|
|
||||||
|
const msg = canonicalPostBytes({
|
||||||
|
postId,
|
||||||
|
authorId: author.userId,
|
||||||
|
publishedAt,
|
||||||
|
content,
|
||||||
|
federationUrl: author.instanceUrl,
|
||||||
|
});
|
||||||
|
const sig = nacl.sign.detached(msg, author.identity.signingSecretKey);
|
||||||
|
const signature = Buffer.from(sig).toString("base64");
|
||||||
|
|
||||||
|
const res = await fetch(`${author.instanceUrl}/api/auth/social/posts`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
Authorization: `Bearer ${author.bearerToken}`,
|
||||||
|
},
|
||||||
|
body: JSON.stringify({ postId, publishedAt, signature, content }),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
const json = (await readJsonSafe(res)) as { id?: string; federationDeliveriesQueued?: number } | null;
|
||||||
|
if (!res.ok) {
|
||||||
|
throw new Error(`createPost on ${author.instanceUrl} failed (${res.status}): ${JSON.stringify(json)}`);
|
||||||
|
}
|
||||||
|
return {
|
||||||
|
postId: json?.id ?? postId,
|
||||||
|
federationDeliveriesQueued: json?.federationDeliveriesQueued ?? 0,
|
||||||
|
raw: json,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,6 +1,7 @@
|
||||||
// tests/helpers/db.ts
|
// tests/helpers/db.ts
|
||||||
import db from "@/lib/db";
|
import db from "@/lib/db";
|
||||||
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
import { blacklistedServers, rotateChallengeTokens, serverRegistry } from "@/lib/db/schema";
|
||||||
|
import getRedisClient from "@/lib/redis";
|
||||||
import { eq } from "drizzle-orm";
|
import { eq } from "drizzle-orm";
|
||||||
import nacl from "tweetnacl";
|
import nacl from "tweetnacl";
|
||||||
|
|
||||||
|
|
@ -52,25 +53,21 @@ export async function getServerByUrl(url: string) {
|
||||||
return (await db.select().from(serverRegistry).where(eq(serverRegistry.url, url)))[0]
|
return (await db.select().from(serverRegistry).where(eq(serverRegistry.url, url)))[0]
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function clearServerRegistry() {
|
async function clearServerRegistry() {
|
||||||
return await db.delete(serverRegistry)
|
return await db.delete(serverRegistry)
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function clearRotateChallengeTokens() {
|
async function clearRotateChallengeTokens() {
|
||||||
return await db.delete(rotateChallengeTokens)
|
return await db.delete(rotateChallengeTokens)
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function insertServerEcho(url: string, publicKey: string, encryptionPublicKey: string) {
|
export async function seedBlacklist(serverUrl: string, reason = "test-blacklist") {
|
||||||
await db.insert(serverRegistry).values({
|
await db.insert(blacklistedServers).values({
|
||||||
id: crypto.randomUUID(),
|
id: crypto.randomUUID(),
|
||||||
url,
|
serverUrl,
|
||||||
publicKey,
|
|
||||||
encryptionPublicKey,
|
|
||||||
lastSeen: new Date(),
|
|
||||||
createdAt: new Date(),
|
createdAt: new Date(),
|
||||||
updatedAt: new Date(),
|
reason,
|
||||||
isHealthy: true,
|
})
|
||||||
}).onConflictDoNothing()
|
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function getBlacklistedServer(serverUrl: string) {
|
export async function getBlacklistedServer(serverUrl: string) {
|
||||||
|
|
@ -81,14 +78,27 @@ export async function getChallengesByServerUrl(serverUrl: string) {
|
||||||
return await db.select().from(rotateChallengeTokens).where(eq(rotateChallengeTokens.serverUrl, serverUrl))
|
return await db.select().from(rotateChallengeTokens).where(eq(rotateChallengeTokens.serverUrl, serverUrl))
|
||||||
}
|
}
|
||||||
|
|
||||||
export async function clearBlacklist() {
|
async function clearBlacklist() {
|
||||||
return await db.delete(blacklistedServers)
|
return await db.delete(blacklistedServers)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Rotation `/discover/rotate/init` uses Redis `checkRateLimit("rotate-init:<url>")`.
|
||||||
|
* DB truncation alone leaves buckets hot across Playwright tests (same SERVER_URL).
|
||||||
|
*/
|
||||||
|
async function clearRotateInitRateLimitKeys() {
|
||||||
|
const redis = getRedisClient();
|
||||||
|
const keys = await redis.keys("rl:rotate-init:*");
|
||||||
|
if (keys.length > 0) {
|
||||||
|
await redis.del(...keys);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
export async function clearTables() {
|
export async function clearTables() {
|
||||||
return await Promise.all([
|
await Promise.all([
|
||||||
clearRotateChallengeTokens(),
|
clearRotateChallengeTokens(),
|
||||||
clearBlacklist(),
|
clearBlacklist(),
|
||||||
clearServerRegistry(),
|
clearServerRegistry(),
|
||||||
])
|
]);
|
||||||
|
await clearRotateInitRateLimitKeys();
|
||||||
}
|
}
|
||||||
|
|
|
||||||
21
tests/helpers/identity.ts
Normal file
21
tests/helpers/identity.ts
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
import db from "@/lib/db";
|
||||||
|
import { user } from "@/lib/db/schema";
|
||||||
|
|
||||||
|
/** Minimal user row for proxy / federation fixture tests (no accounts OAuth rows). */
|
||||||
|
export async function seedMinimalUser(opts: {
|
||||||
|
id: string;
|
||||||
|
email: string;
|
||||||
|
name?: string;
|
||||||
|
isPrivate?: boolean;
|
||||||
|
}) {
|
||||||
|
const now = new Date();
|
||||||
|
await db.insert(user).values({
|
||||||
|
id: opts.id,
|
||||||
|
name: opts.name ?? "Fixture User",
|
||||||
|
email: opts.email,
|
||||||
|
emailVerified: true,
|
||||||
|
createdAt: now,
|
||||||
|
updatedAt: now,
|
||||||
|
isPrivate: opts.isPrivate ?? false,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
import { Queue, type Job } from "bullmq"
|
|
||||||
import Redis from "ioredis"
|
|
||||||
|
|
||||||
function createRedis() {
|
|
||||||
return new Redis(process.env.REDIS_URL!, { maxRetriesPerRequest: null })
|
|
||||||
}
|
|
||||||
|
|
||||||
const HEALTH_CHECK_QUEUE = "federation-health-check"
|
|
||||||
const RETRY_QUEUE = "federation-retry"
|
|
||||||
|
|
||||||
let _healthQueue: Queue | null = null
|
|
||||||
let _retryQueue: Queue | null = null
|
|
||||||
|
|
||||||
export function getTestHealthCheckQueue(): Queue {
|
|
||||||
if (!_healthQueue) {
|
|
||||||
_healthQueue = new Queue(HEALTH_CHECK_QUEUE, { connection: createRedis() as never })
|
|
||||||
}
|
|
||||||
return _healthQueue
|
|
||||||
}
|
|
||||||
|
|
||||||
export function getTestRetryQueue(): Queue {
|
|
||||||
if (!_retryQueue) {
|
|
||||||
_retryQueue = new Queue(RETRY_QUEUE, { connection: createRedis() as never })
|
|
||||||
}
|
|
||||||
return _retryQueue
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function getHealthCheckJobsFor(serverUrl: string): Promise<Job[]> {
|
|
||||||
const queue = getTestHealthCheckQueue()
|
|
||||||
const jobs = await queue.getJobs(["waiting", "delayed", "active", "completed", "failed"])
|
|
||||||
return jobs.filter((j) => j.data?.serverUrl === serverUrl)
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function getRetryJobsFor(serverUrl: string): Promise<Job[]> {
|
|
||||||
const queue = getTestRetryQueue()
|
|
||||||
const jobs = await queue.getJobs(["waiting", "delayed", "active", "completed", "failed"])
|
|
||||||
return jobs.filter((j) => j.data?.serverUrl === serverUrl)
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function drainAllQueues(): Promise<void> {
|
|
||||||
const hq = getTestHealthCheckQueue()
|
|
||||||
const rq = getTestRetryQueue()
|
|
||||||
await hq.obliterate({ force: true }).catch(() => {})
|
|
||||||
await rq.obliterate({ force: true }).catch(() => {})
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function closeQueues(): Promise<void> {
|
|
||||||
if (_healthQueue) { await _healthQueue.close(); _healthQueue = null }
|
|
||||||
if (_retryQueue) { await _retryQueue.close(); _retryQueue = null }
|
|
||||||
}
|
|
||||||
39
tests/integration/README.md
Normal file
39
tests/integration/README.md
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
# Manual federation integration scripts
|
||||||
|
|
||||||
|
These are **not** run by Playwright (`npm test`). They are Bun scripts that assume three live Sipher federation instances (A = local `.env.local`, B = proxy, C = target) with Redis, Postgres, workers, and completed mutual discovery.
|
||||||
|
|
||||||
|
## Scripts
|
||||||
|
|
||||||
|
| Script | npm shortcut |
|
||||||
|
| ---------------------------------------------------------- | ----------------------------------- |
|
||||||
|
| [discover.ts](discover.ts) | `npm run docker:test:discover` |
|
||||||
|
| [federation-post-delivery.ts](federation-post-delivery.ts) | `npm run docker:test:post-delivery` |
|
||||||
|
| [proxy-chain.ts](proxy-chain.ts) | `npm run docker:test:proxy-chain` |
|
||||||
|
|
||||||
|
### discover.ts
|
||||||
|
|
||||||
|
- Exercises **Server A**'s `/discover` endpoint (`GET`, `POST REGISTER`, `POST DISCOVER`) using **Server C** as the live remote peer — no stub layer.
|
||||||
|
- Covers: peer ordering / healthy filter, input validation, SSRF rejection, unreachable peers, key-mismatch & existing-registration conflicts, encrypted DISCOVER envelopes (decryption + fingerprint match), happy paths for both REGISTER and DISCOVER round-trips.
|
||||||
|
- Snapshots and restores A's `server_registry` so the mesh is intact for subsequent integration tests.
|
||||||
|
- **Flags**: `--peer` (default `http://sipher-c:3002`).
|
||||||
|
|
||||||
|
### federation-post-delivery.ts
|
||||||
|
|
||||||
|
- Exercises **Server A**: `POST /api/auth/social/posts` → BullMQ worker → `federationFetch` (direct or via proxy **B**) → **C**.
|
||||||
|
- **Requires**: `.env.local` with federation keys, `DATABASE_URL`, `REDIS_URL`, worker running; a Bearer token on **A**; accepted remote follower URLs pointing at **C**.
|
||||||
|
- **Flags**: `--proxy`, `--target`, `--bearer`, optional `--test-fallback`, `--test-no-remote-followers`.
|
||||||
|
|
||||||
|
### proxy-chain.ts
|
||||||
|
|
||||||
|
- Exercises **PROXY** and **TARGETED** RPC paths across **A → B → C**, sender-key rejection, unknown sender, and the real failover path `A → C (direct FAILS) → A → B → C` driven by `federationFetch`'s `proxyFallback` against a DNS-blocked target URL.
|
||||||
|
- **Requires**: three servers up; mutual discovery so **A** appears on **B**’s and **C**’s peer lists; for fallback tests, `--bearer` and `--user`.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- `.env.local` populated (`BETTER_AUTH_URL`, federation keys, DB, Redis, etc.).
|
||||||
|
- `bun` installed (scripts use `bun run`).
|
||||||
|
- Federation registry populated via discovery between instances before relay/post tests.
|
||||||
|
|
||||||
|
## Limitations
|
||||||
|
|
||||||
|
- Failures are often environmental (TLS, Docker networking, firewall, stale registry). Use worker logs with `DEBUG=app:federation:*` when jobs hang.
|
||||||
687
tests/integration/discover.ts
Normal file
687
tests/integration/discover.ts
Normal file
|
|
@ -0,0 +1,687 @@
|
||||||
|
/**
|
||||||
|
* Discover route integration test.
|
||||||
|
*
|
||||||
|
* Exercises `/discover` (`GET`, `POST REGISTER`, `POST DISCOVER`) on Server A
|
||||||
|
* using Server C from the federation cluster as the real remote peer — there
|
||||||
|
* is no stub layer. Every `federationFetch` the route makes against the peer
|
||||||
|
* lands on an actual sipher-c instance with real signing/encryption keys.
|
||||||
|
*
|
||||||
|
* Run inside the Docker test cluster:
|
||||||
|
*
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
* tests/integration/discover.ts --peer http://sipher-c:3002
|
||||||
|
*
|
||||||
|
* `--peer` defaults to `http://sipher-c:3002` if omitted.
|
||||||
|
*
|
||||||
|
* Coverage parity with the previous (deleted) `tests/federation/discover.e2e.ts`:
|
||||||
|
* 1. GET /discover returns own keys and only healthy peers ordered by lastSeen desc.
|
||||||
|
* 2. POST /discover rejects invalid JSON.
|
||||||
|
* 3. POST /discover rejects unknown method.
|
||||||
|
* 4. REGISTER rejects malformed signing-key length.
|
||||||
|
* 5. REGISTER rejects SSRF URL.
|
||||||
|
* 6. REGISTER returns 502 when peer is unreachable.
|
||||||
|
* 7. REGISTER rejects key mismatch vs remote GET /discover.
|
||||||
|
* 8. REGISTER rejects when URL already registered with different keys.
|
||||||
|
* 9. REGISTER happy path upserts the peer into the registry.
|
||||||
|
* 10. DISCOVER returns 404 when signing public key is unknown.
|
||||||
|
* 11. DISCOVER rejects blocked stored URL with 400.
|
||||||
|
* 12. DISCOVER returns 502 when stored peer is unreachable.
|
||||||
|
* 13. DISCOVER rejects invalid envelope (undecryptable ciphertext).
|
||||||
|
* 14. DISCOVER rejects fingerprint mismatch inside decrypted envelope.
|
||||||
|
* 15. DISCOVER rejects malformed envelope shape.
|
||||||
|
* 16. DISCOVER happy path confirms keys against the live peer.
|
||||||
|
*
|
||||||
|
* Whatever the test does to A's `server_registry`, it restores at the end so
|
||||||
|
* that subsequent integration tests inherit a working mesh.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import db from "@/lib/db";
|
||||||
|
import { serverRegistry } from "@/lib/db/schema";
|
||||||
|
import { encryptPayload, fingerprintKey } from "@/lib/federation/keytools";
|
||||||
|
import { config } from "dotenv";
|
||||||
|
import { eq } from "drizzle-orm";
|
||||||
|
|
||||||
|
config({ path: ".env.local" });
|
||||||
|
|
||||||
|
const FETCH_TIMEOUT_MS = 15_000;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Required env (test-runner uses sipher-a.env)
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const REQUIRED_ENV = [
|
||||||
|
"FEDERATION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_PRIVATE_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PRIVATE_KEY",
|
||||||
|
"BETTER_AUTH_URL",
|
||||||
|
] as const;
|
||||||
|
|
||||||
|
const missing = REQUIRED_ENV.filter((k) => !process.env[k]);
|
||||||
|
if (missing.length > 0) {
|
||||||
|
console.error("Missing required environment variables:");
|
||||||
|
missing.forEach((k) => console.error(` - ${k}`));
|
||||||
|
console.error("Run inside the docker test cluster (env_file: tests/docker/sipher-a.env).");
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const ORIGIN = process.env.BETTER_AUTH_URL!;
|
||||||
|
const OWN_SIGNING_PUB = process.env.FEDERATION_PUBLIC_KEY!;
|
||||||
|
const OWN_ENCRYPTION_PUB = process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// CLI args
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function argAfter(flag: string): string | undefined {
|
||||||
|
const idx = process.argv.indexOf(flag);
|
||||||
|
return idx !== -1 ? process.argv[idx + 1] : undefined;
|
||||||
|
}
|
||||||
|
|
||||||
|
const peerUrl = argAfter("--peer") ?? "http://sipher-c:3002";
|
||||||
|
|
||||||
|
console.log("Discover route test");
|
||||||
|
console.log(` Server A (us): ${ORIGIN}`);
|
||||||
|
console.log(` Peer (real): ${peerUrl}`);
|
||||||
|
console.log(` A signing key: ${fingerprintKey(OWN_SIGNING_PUB).slice(0, 16)}…`);
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Test harness (matches proxy-chain.ts so output is consistent across the suite)
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
interface TestResult {
|
||||||
|
name: string;
|
||||||
|
passed: boolean;
|
||||||
|
message: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
const results: TestResult[] = [];
|
||||||
|
|
||||||
|
function pass(name: string, message = "OK") {
|
||||||
|
console.log(` ✔ ${name}`);
|
||||||
|
if (message !== "OK") console.log(` ${message}`);
|
||||||
|
results.push({ name, passed: true, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
function fail(name: string, message: string) {
|
||||||
|
console.error(` ✘ ${name}`);
|
||||||
|
console.error(` ${message}`);
|
||||||
|
results.push({ name, passed: false, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
async function readErrorBody(response: Response): Promise<string> {
|
||||||
|
try {
|
||||||
|
const body = await response.json();
|
||||||
|
return body?.error ?? body?.message ?? JSON.stringify(body);
|
||||||
|
} catch {
|
||||||
|
try {
|
||||||
|
return await response.text();
|
||||||
|
} catch {
|
||||||
|
return response.statusText;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function randomKeyPair() {
|
||||||
|
// Anonymous helper — we deliberately use signed bytes of any size for
|
||||||
|
// "wrong key" tests so we don't accidentally rely on libsodium primitives
|
||||||
|
// matching the validity rules under test.
|
||||||
|
const bytes = (len: number) => Buffer.from(crypto.getRandomValues(new Uint8Array(len)));
|
||||||
|
return {
|
||||||
|
signingPublicKey: bytes(32).toString("base64"),
|
||||||
|
encryptionPublicKey: bytes(32).toString("base64"),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
async function postDiscover(body: unknown, contentType = "application/json") {
|
||||||
|
return fetch(`${ORIGIN}/discover`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": contentType,
|
||||||
|
"X-Federation-Origin": ORIGIN,
|
||||||
|
"Origin": ORIGIN,
|
||||||
|
},
|
||||||
|
body: typeof body === "string" ? body : JSON.stringify(body),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function ownEncryptionPublicKeyBytes(): Uint8Array {
|
||||||
|
return new Uint8Array(Buffer.from(OWN_ENCRYPTION_PUB, "base64"));
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildDiscoverEnvelope(url: string, signingPub: string, encPub: string) {
|
||||||
|
const plaintext = JSON.stringify({
|
||||||
|
url,
|
||||||
|
publicKeyFingerprint: fingerprintKey(signingPub),
|
||||||
|
encryptionPublicKeyFingerprint: fingerprintKey(encPub),
|
||||||
|
});
|
||||||
|
return encryptPayload(plaintext, ownEncryptionPublicKeyBytes());
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Discover the live peer's keys once (sipher-c will return them via GET /discover)
|
||||||
|
// and capture A's pre-existing mesh entries so we can restore them at the end.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Snapshotting cluster state ───────────────────────────");
|
||||||
|
|
||||||
|
interface PeerKeys {
|
||||||
|
publicKey: string;
|
||||||
|
encryptionPublicKey: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function fetchPeerKeys(url: string): Promise<PeerKeys> {
|
||||||
|
const res = await fetch(`${url}/discover`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
|
||||||
|
if (!res.ok) {
|
||||||
|
throw new Error(`GET ${url}/discover returned ${res.status}`);
|
||||||
|
}
|
||||||
|
const body = await res.json();
|
||||||
|
return { publicKey: body.publicKey, encryptionPublicKey: body.encryptionPublicKey };
|
||||||
|
}
|
||||||
|
|
||||||
|
const peerKeys = await fetchPeerKeys(peerUrl);
|
||||||
|
console.log(` Peer signing key: ${fingerprintKey(peerKeys.publicKey).slice(0, 16)}…`);
|
||||||
|
console.log(` Peer encryption key: ${fingerprintKey(peerKeys.encryptionPublicKey).slice(0, 16)}…`);
|
||||||
|
|
||||||
|
const meshSnapshot = await db.select().from(serverRegistry);
|
||||||
|
console.log(` Snapshotted ${meshSnapshot.length} existing registry entries.`);
|
||||||
|
|
||||||
|
async function restoreMesh() {
|
||||||
|
// Wipe everything, then re-insert the snapshot. Idempotent and safe to
|
||||||
|
// call even after partial failures inside individual tests.
|
||||||
|
await db.delete(serverRegistry);
|
||||||
|
for (const row of meshSnapshot) {
|
||||||
|
await db.insert(serverRegistry).values(row).onConflictDoNothing();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 1. GET /discover returns own keys and only healthy peers, ordered by lastSeen desc
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: GET /discover ──────────────────────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "GET /discover orders healthy peers by lastSeen desc";
|
||||||
|
const newer = "http://discover-test-peer-newer.invalid";
|
||||||
|
const older = "http://discover-test-peer-older.invalid";
|
||||||
|
try {
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, newer));
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, older));
|
||||||
|
|
||||||
|
const k1 = randomKeyPair();
|
||||||
|
const k2 = randomKeyPair();
|
||||||
|
await db.insert(serverRegistry).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
url: newer,
|
||||||
|
publicKey: k1.signingPublicKey,
|
||||||
|
encryptionPublicKey: k1.encryptionPublicKey,
|
||||||
|
isHealthy: true,
|
||||||
|
lastSeen: new Date(),
|
||||||
|
createdAt: new Date(),
|
||||||
|
updatedAt: new Date(),
|
||||||
|
});
|
||||||
|
await db.insert(serverRegistry).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
url: older,
|
||||||
|
publicKey: k2.signingPublicKey,
|
||||||
|
encryptionPublicKey: k2.encryptionPublicKey,
|
||||||
|
isHealthy: true,
|
||||||
|
lastSeen: new Date(Date.now() - 120_000),
|
||||||
|
createdAt: new Date(Date.now() - 120_000),
|
||||||
|
updatedAt: new Date(Date.now() - 120_000),
|
||||||
|
});
|
||||||
|
|
||||||
|
const res = await fetch(`${ORIGIN}/discover`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
|
||||||
|
if (!res.ok) {
|
||||||
|
fail(testName, `GET /discover returned ${res.status}`);
|
||||||
|
} else {
|
||||||
|
const body = await res.json();
|
||||||
|
const peerUrls = body.peers.map((p: { url: string }) => p.url);
|
||||||
|
const newerIdx = peerUrls.indexOf(newer);
|
||||||
|
const olderIdx = peerUrls.indexOf(older);
|
||||||
|
if (body.url !== ORIGIN) {
|
||||||
|
fail(testName, `expected url=${ORIGIN}, got ${body.url}`);
|
||||||
|
} else if (body.publicKey !== OWN_SIGNING_PUB) {
|
||||||
|
fail(testName, "GET /discover did not echo own signing key");
|
||||||
|
} else if (newerIdx === -1 || olderIdx === -1) {
|
||||||
|
fail(testName, `seeded peers missing from response (newer=${newerIdx}, older=${olderIdx})`);
|
||||||
|
} else if (newerIdx > olderIdx) {
|
||||||
|
fail(testName, `newer peer (idx ${newerIdx}) should come before older (idx ${olderIdx})`);
|
||||||
|
} else {
|
||||||
|
// Health filter: mark older unhealthy and re-check.
|
||||||
|
await db.update(serverRegistry).set({ isHealthy: false }).where(eq(serverRegistry.url, older));
|
||||||
|
const res2 = await fetch(`${ORIGIN}/discover`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
|
||||||
|
const body2 = await res2.json();
|
||||||
|
const peerUrls2 = body2.peers.map((p: { url: string }) => p.url);
|
||||||
|
if (peerUrls2.includes(older)) {
|
||||||
|
fail(testName, "unhealthy peer should be filtered out but still appears");
|
||||||
|
} else if (!peerUrls2.includes(newer)) {
|
||||||
|
fail(testName, "healthy peer disappeared after toggling sibling unhealthy");
|
||||||
|
} else {
|
||||||
|
pass(testName, `${peerUrls.length} peers seen; ordering & healthy filter OK`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
} finally {
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, newer));
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, older));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 2-3. POST /discover input validation
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: POST /discover input validation ────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "rejects invalid JSON";
|
||||||
|
try {
|
||||||
|
const res = await postDiscover("{not-json");
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && body.code === "INVALID_JSON") {
|
||||||
|
pass(testName);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400/INVALID_JSON, got ${res.status}/${body.code}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "rejects unknown method";
|
||||||
|
try {
|
||||||
|
const res = await postDiscover({ method: "NOT_A_REAL_METHOD" });
|
||||||
|
if (res.status === 400) {
|
||||||
|
pass(testName, await readErrorBody(res));
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400, got ${res.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 4-9. REGISTER scenarios
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: REGISTER ───────────────────────────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER rejects malformed signing-key length";
|
||||||
|
try {
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: peerUrl,
|
||||||
|
publicKey: Buffer.alloc(31).toString("base64"),
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
if (res.status === 400) {
|
||||||
|
pass(testName);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400, got ${res.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER rejects SSRF URL";
|
||||||
|
try {
|
||||||
|
const k = randomKeyPair();
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: "http://10.0.0.1/",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
if (res.status === 400) {
|
||||||
|
pass(testName);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400, got ${res.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER returns 502 when peer is unreachable";
|
||||||
|
try {
|
||||||
|
const k = randomKeyPair();
|
||||||
|
// sipher-unreachable.test is allow-listed in DEV_ALLOWED_HOSTNAMES but
|
||||||
|
// fails DNS — the same trick the proxy-chain failover test uses.
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: "http://sipher-unreachable.test:9999/",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 502) {
|
||||||
|
pass(testName, `code=${body.code}`);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 502, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER rejects key mismatch vs remote GET /discover";
|
||||||
|
try {
|
||||||
|
const wrong = randomKeyPair();
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: peerUrl,
|
||||||
|
publicKey: wrong.signingPublicKey,
|
||||||
|
encryptionPublicKey: wrong.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && /Public keys do not match/i.test(body.error)) {
|
||||||
|
pass(testName, body.error);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400 with "Public keys do not match", got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER rejects URL already registered with different keys";
|
||||||
|
try {
|
||||||
|
// Pre-state: replace A's registry entry for the peer with wrong keys
|
||||||
|
// so the route's "existing registration with mismatched key" branch
|
||||||
|
// fires. We restore the correct entry from the mesh snapshot at the
|
||||||
|
// end of the file.
|
||||||
|
const wrong = randomKeyPair();
|
||||||
|
await db
|
||||||
|
.update(serverRegistry)
|
||||||
|
.set({ publicKey: wrong.signingPublicKey, encryptionPublicKey: wrong.encryptionPublicKey })
|
||||||
|
.where(eq(serverRegistry.url, peerUrl));
|
||||||
|
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: peerUrl,
|
||||||
|
publicKey: peerKeys.publicKey,
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && /key rotation flow/i.test(body.error)) {
|
||||||
|
pass(testName, body.error);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400 mentioning "key rotation flow", got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
} finally {
|
||||||
|
// Restore the correct entry before the next test relies on it.
|
||||||
|
await db
|
||||||
|
.update(serverRegistry)
|
||||||
|
.set({ publicKey: peerKeys.publicKey, encryptionPublicKey: peerKeys.encryptionPublicKey })
|
||||||
|
.where(eq(serverRegistry.url, peerUrl));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "REGISTER happy path upserts the peer into the registry";
|
||||||
|
try {
|
||||||
|
// Drop A's entry for the peer first so we genuinely exercise the
|
||||||
|
// insert path (the route upserts, but seeing an unchanged row would
|
||||||
|
// be unconvincing). The mesh snapshot will restore it at the end.
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, peerUrl));
|
||||||
|
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "REGISTER",
|
||||||
|
url: peerUrl,
|
||||||
|
publicKey: peerKeys.publicKey,
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status !== 200) {
|
||||||
|
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
} else {
|
||||||
|
const row = (await db.select().from(serverRegistry).where(eq(serverRegistry.url, peerUrl)))[0];
|
||||||
|
if (!row) {
|
||||||
|
fail(testName, "registry row missing after REGISTER 200");
|
||||||
|
} else if (row.publicKey !== peerKeys.publicKey) {
|
||||||
|
fail(testName, "registry signing key mismatch after REGISTER");
|
||||||
|
} else if (row.encryptionPublicKey !== peerKeys.encryptionPublicKey) {
|
||||||
|
fail(testName, "registry encryption key mismatch after REGISTER");
|
||||||
|
} else if (body.echo?.publicKey !== OWN_SIGNING_PUB) {
|
||||||
|
fail(testName, "REGISTER response did not echo own signing key");
|
||||||
|
} else {
|
||||||
|
pass(testName, `peer ${peerUrl} registered with real keys from live GET /discover`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 10-16. DISCOVER scenarios
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: DISCOVER ───────────────────────────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER returns 404 when signing public key is unknown";
|
||||||
|
try {
|
||||||
|
const k = randomKeyPair();
|
||||||
|
const envelope = buildDiscoverEnvelope("http://unused.invalid", k.signingPublicKey, k.encryptionPublicKey);
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
envelope,
|
||||||
|
});
|
||||||
|
if (res.status === 404) {
|
||||||
|
pass(testName);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 404, got ${res.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER rejects blocked stored URL with 400";
|
||||||
|
const blockedUrl = "http://10.0.0.2:999/";
|
||||||
|
const k = randomKeyPair();
|
||||||
|
try {
|
||||||
|
await db.insert(serverRegistry).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
url: blockedUrl,
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
isHealthy: true,
|
||||||
|
lastSeen: new Date(),
|
||||||
|
createdAt: new Date(),
|
||||||
|
updatedAt: new Date(),
|
||||||
|
});
|
||||||
|
|
||||||
|
const envelope = buildDiscoverEnvelope(blockedUrl, k.signingPublicKey, k.encryptionPublicKey);
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
envelope,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && /stored server URL is blocked/i.test(body.error)) {
|
||||||
|
pass(testName, body.error);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400 "blocked", got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
} finally {
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, blockedUrl));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER returns 502 when stored peer is unreachable";
|
||||||
|
const deadUrl = "http://sipher-unreachable.test:9999/";
|
||||||
|
const k = randomKeyPair();
|
||||||
|
try {
|
||||||
|
await db.insert(serverRegistry).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
url: deadUrl,
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
isHealthy: true,
|
||||||
|
lastSeen: new Date(),
|
||||||
|
createdAt: new Date(),
|
||||||
|
updatedAt: new Date(),
|
||||||
|
});
|
||||||
|
|
||||||
|
const envelope = buildDiscoverEnvelope(deadUrl, k.signingPublicKey, k.encryptionPublicKey);
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
envelope,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 502) {
|
||||||
|
pass(testName, `code=${body.code}`);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 502, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
} finally {
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, deadUrl));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER rejects invalid envelope (undecryptable ciphertext)";
|
||||||
|
try {
|
||||||
|
// The peer entry for the real cluster peer is already in registry, but
|
||||||
|
// the envelope check happens during zod validation BEFORE any peer fetch,
|
||||||
|
// so the test never depends on the peer being reachable.
|
||||||
|
const goodEnvelope = buildDiscoverEnvelope(peerUrl, peerKeys.publicKey, peerKeys.encryptionPublicKey);
|
||||||
|
const broken = {
|
||||||
|
...goodEnvelope,
|
||||||
|
ciphertext: Buffer.alloc(Buffer.from(goodEnvelope.ciphertext, "base64").length, 0).toString("base64"),
|
||||||
|
};
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: peerKeys.publicKey,
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
envelope: broken,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && /Invalid envelope/i.test(body.error)) {
|
||||||
|
pass(testName, body.error);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400 "Invalid envelope", got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER rejects fingerprint mismatch inside decrypted envelope";
|
||||||
|
try {
|
||||||
|
const plaintext = JSON.stringify({
|
||||||
|
url: peerUrl,
|
||||||
|
publicKeyFingerprint: "deadbeef",
|
||||||
|
encryptionPublicKeyFingerprint: fingerprintKey(peerKeys.encryptionPublicKey),
|
||||||
|
});
|
||||||
|
const envelope = encryptPayload(plaintext, ownEncryptionPublicKeyBytes());
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: peerKeys.publicKey,
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
envelope,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status === 400 && /signing public key/i.test(body.error)) {
|
||||||
|
pass(testName, body.error);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400 mentioning signing public key, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER rejects malformed envelope shape";
|
||||||
|
try {
|
||||||
|
const k = randomKeyPair();
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: k.signingPublicKey,
|
||||||
|
encryptionPublicKey: k.encryptionPublicKey,
|
||||||
|
envelope: { ephemeralPublicKey: "AA", iv: "AA", ciphertext: "AA" /* missing authTag */ },
|
||||||
|
});
|
||||||
|
if (res.status === 400) {
|
||||||
|
pass(testName);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 400, got ${res.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "DISCOVER happy path confirms keys against the live peer";
|
||||||
|
try {
|
||||||
|
const envelope = buildDiscoverEnvelope(peerUrl, peerKeys.publicKey, peerKeys.encryptionPublicKey);
|
||||||
|
const res = await postDiscover({
|
||||||
|
method: "DISCOVER",
|
||||||
|
publicKey: peerKeys.publicKey,
|
||||||
|
encryptionPublicKey: peerKeys.encryptionPublicKey,
|
||||||
|
envelope,
|
||||||
|
});
|
||||||
|
const body = await res.json();
|
||||||
|
if (res.status !== 200) {
|
||||||
|
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
} else if (body.sameKeyOnServer !== true || body.sameKeyOnFetch !== true) {
|
||||||
|
fail(testName, `expected both confirmations true, got ${JSON.stringify(body)}`);
|
||||||
|
} else {
|
||||||
|
pass(testName, "live peer GET /discover confirmed local registry keys");
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Restore cluster mesh state and report
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
await restoreMesh();
|
||||||
|
console.log("\n Restored original mesh snapshot.");
|
||||||
|
|
||||||
|
const passed = results.filter((r) => r.passed);
|
||||||
|
const failed = results.filter((r) => !r.passed);
|
||||||
|
|
||||||
|
console.log("\n════════════════════════════════════════════════════════");
|
||||||
|
console.log(`Results: ${passed.length} passed, ${failed.length} failed out of ${results.length}`);
|
||||||
|
|
||||||
|
if (failed.length > 0) {
|
||||||
|
console.error("\nFailed tests:");
|
||||||
|
failed.forEach((f) => console.error(` ✘ ${f.name}: ${f.message}`));
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\nAll tests passed.");
|
||||||
|
process.exit(0);
|
||||||
409
tests/integration/federation-post-delivery.ts
Normal file
409
tests/integration/federation-post-delivery.ts
Normal file
|
|
@ -0,0 +1,409 @@
|
||||||
|
/**
|
||||||
|
* Self-contained federation post delivery test.
|
||||||
|
*
|
||||||
|
* 1. Auto-creates Alice on Server A and Bob on Server C through Better Auth
|
||||||
|
* (`POST /api/auth/sign-up/email` → `/sign-in/email` → `/oven/identity/register`).
|
||||||
|
* 2. Seeds the follow rows that A's post-propagation logic needs to mark Bob
|
||||||
|
* as a remote follower hosted on C.
|
||||||
|
* 3. Has Alice sign and submit a real post through A's social API.
|
||||||
|
* 4. Waits for the BullMQ delivery worker on A to drain the `delivery_jobs`
|
||||||
|
* row that targets C's `/api/auth/social/posts` endpoint.
|
||||||
|
*
|
||||||
|
* Run from inside the Docker test cluster:
|
||||||
|
*
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
* tests/integration/federation-post-delivery.ts \
|
||||||
|
* --proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
*
|
||||||
|
* No `--bearer` flag is required — the script provisions and tears down its own
|
||||||
|
* users on every run. `--proxy` and `--target` default to the docker service
|
||||||
|
* names if omitted.
|
||||||
|
*
|
||||||
|
* Pass `--test-no-remote-followers` to also exercise the case where the author
|
||||||
|
* has no remote followers: the post must save with
|
||||||
|
* `federationDeliveriesQueued === 0` and no delivery jobs are queued.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import db from "@/lib/db";
|
||||||
|
import { deliveryJobs, follows, serverRegistry } from "@/lib/db/schema";
|
||||||
|
import { fingerprintKey } from "@/lib/federation/keytools";
|
||||||
|
import { config } from "dotenv";
|
||||||
|
import { and, desc, eq, like } from "drizzle-orm";
|
||||||
|
import { createPostOverHttp, createSipherUser, type SipherTestUser } from "../helpers/auth-users";
|
||||||
|
|
||||||
|
config({ path: ".env.local" });
|
||||||
|
|
||||||
|
const FETCH_TIMEOUT_MS = 15_000;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Helpers
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
interface TestResult {
|
||||||
|
name: string;
|
||||||
|
passed: boolean;
|
||||||
|
message: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
const results: TestResult[] = [];
|
||||||
|
|
||||||
|
function pass(name: string, message = "OK") {
|
||||||
|
console.log(` ✔ ${name}`);
|
||||||
|
if (message !== "OK") console.log(` ${message}`);
|
||||||
|
results.push({ name, passed: true, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
function fail(name: string, message: string) {
|
||||||
|
console.error(` ✘ ${name}`);
|
||||||
|
console.error(` ${message}`);
|
||||||
|
results.push({ name, passed: false, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
async function readErrorBody(response: Response): Promise<string> {
|
||||||
|
try {
|
||||||
|
const body = await response.json();
|
||||||
|
return body?.error ?? body?.message ?? JSON.stringify(body);
|
||||||
|
} catch {
|
||||||
|
try {
|
||||||
|
return await response.text();
|
||||||
|
} catch {
|
||||||
|
return response.statusText;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Validate environment
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const REQUIRED_ENV = [
|
||||||
|
"FEDERATION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_PRIVATE_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PRIVATE_KEY",
|
||||||
|
"BETTER_AUTH_URL",
|
||||||
|
] as const;
|
||||||
|
|
||||||
|
const missing = REQUIRED_ENV.filter((k) => !process.env[k]);
|
||||||
|
if (missing.length > 0) {
|
||||||
|
console.error("Missing required environment variables:");
|
||||||
|
missing.forEach((k) => console.error(` - ${k}`));
|
||||||
|
console.error("Run inside the docker test cluster (env_file: tests/docker/sipher-a.env).");
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const ORIGIN = process.env.BETTER_AUTH_URL!;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Parse arguments
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function argAfter(flag: string): string | undefined {
|
||||||
|
const idx = process.argv.indexOf(flag);
|
||||||
|
return idx !== -1 ? process.argv[idx + 1] : undefined;
|
||||||
|
}
|
||||||
|
|
||||||
|
const proxyUrl = argAfter("--proxy") ?? "http://sipher-b:3001";
|
||||||
|
const targetUrl = argAfter("--target") ?? "http://sipher-c:3002";
|
||||||
|
const testNoRemoteFollowers = process.argv.includes("--test-no-remote-followers");
|
||||||
|
|
||||||
|
console.log("Post delivery test (A API → worker → C, with auto-created users)");
|
||||||
|
console.log(` Server A (us): ${ORIGIN}`);
|
||||||
|
console.log(` Server B (proxy): ${proxyUrl}`);
|
||||||
|
console.log(` Server C (target): ${targetUrl}`);
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 1. Discovery sanity check
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
interface DiscoverResponse {
|
||||||
|
url: string;
|
||||||
|
publicKey: string;
|
||||||
|
encryptionPublicKey: string;
|
||||||
|
peers: { url: string; isHealthy: boolean }[];
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\n── Discovery ────────────────────────────────────────────");
|
||||||
|
|
||||||
|
async function fetchDiscover(url: string, label: string): Promise<DiscoverResponse> {
|
||||||
|
try {
|
||||||
|
const res = await fetch(`${url}/discover`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
|
||||||
|
if (!res.ok) {
|
||||||
|
console.error(`${label} (${url}) returned ${res.status}: ${await readErrorBody(res)}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
const body = (await res.json()) as DiscoverResponse;
|
||||||
|
console.log(` ${label}: ${body.url}`);
|
||||||
|
console.log(` signing: ${fingerprintKey(body.publicKey).slice(0, 16)}…`);
|
||||||
|
console.log(` encryption: ${fingerprintKey(body.encryptionPublicKey).slice(0, 16)}…`);
|
||||||
|
console.log(` peers: ${body.peers.length}`);
|
||||||
|
return body;
|
||||||
|
} catch (err) {
|
||||||
|
console.error(`Cannot reach ${label} at ${url}/discover: ${err instanceof Error ? err.message : err}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const proxyInfo = await fetchDiscover(proxyUrl, "B");
|
||||||
|
const targetInfo = await fetchDiscover(targetUrl, "C");
|
||||||
|
|
||||||
|
const aOnB = proxyInfo.peers.some((p) => p.url === ORIGIN);
|
||||||
|
const aOnC = targetInfo.peers.some((p) => p.url === ORIGIN);
|
||||||
|
console.log(` A registered on B: ${aOnB}`);
|
||||||
|
console.log(` A registered on C: ${aOnC}`);
|
||||||
|
|
||||||
|
if (!aOnB || !aOnC) {
|
||||||
|
console.error(
|
||||||
|
"\n A is not registered on at least one peer. Run mutual discovery first:\n" +
|
||||||
|
" docker compose -f tests/docker-compose.yml --profile setup up",
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Make sure C exists in A's local registry — needed for the follower_server_url FK.
|
||||||
|
const [cRegistry] = await db
|
||||||
|
.select()
|
||||||
|
.from(serverRegistry)
|
||||||
|
.where(eq(serverRegistry.url, targetUrl))
|
||||||
|
.limit(1);
|
||||||
|
|
||||||
|
if (!cRegistry) {
|
||||||
|
console.error(`\n ${targetUrl} is not in A's server_registry. Run mutual discovery first.`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const targetPostsUrl = `${targetUrl.replace(/\/$/, "")}/api/auth/social/posts`;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 2. Create users
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Provisioning test users ─────────────────────────────");
|
||||||
|
|
||||||
|
let alice: SipherTestUser;
|
||||||
|
let bob: SipherTestUser;
|
||||||
|
|
||||||
|
try {
|
||||||
|
alice = await createSipherUser(ORIGIN, { emailPrefix: "alice", usernamePrefix: "alice" });
|
||||||
|
console.log(` Alice on A: ${alice.userId} (${alice.email})`);
|
||||||
|
} catch (err) {
|
||||||
|
console.error(`Failed to create Alice on A: ${err instanceof Error ? err.message : err}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
bob = await createSipherUser(targetUrl, { emailPrefix: "bob", usernamePrefix: "bob" });
|
||||||
|
console.log(` Bob on C: ${bob.userId} (${bob.email})`);
|
||||||
|
} catch (err) {
|
||||||
|
console.error(`Failed to create Bob on C: ${err instanceof Error ? err.message : err}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 3. Seed follow rows on A so post propagation finds C as a federation target.
|
||||||
|
//
|
||||||
|
// post-propagation reads both followers (followingId = alice) and following
|
||||||
|
// (followerId = alice) and only emits delivery jobs when *both* arrays are
|
||||||
|
// non-empty. We insert one row in each direction with the remote URL pointing
|
||||||
|
// at C, which makes C the sole unique federation target.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const createdFollowIds: string[] = [];
|
||||||
|
|
||||||
|
async function seedFollow(opts: {
|
||||||
|
followerId: string;
|
||||||
|
followingId: string;
|
||||||
|
followerServerUrl: string | null;
|
||||||
|
followingServerUrl: string | null;
|
||||||
|
}): Promise<string> {
|
||||||
|
const id = crypto.randomUUID();
|
||||||
|
await db.insert(follows).values({
|
||||||
|
id,
|
||||||
|
followerId: opts.followerId,
|
||||||
|
followingId: opts.followingId,
|
||||||
|
accepted: true,
|
||||||
|
createdAt: new Date(),
|
||||||
|
followerServerUrl: opts.followerServerUrl,
|
||||||
|
followingServerUrl: opts.followingServerUrl,
|
||||||
|
acknowledged: true,
|
||||||
|
});
|
||||||
|
createdFollowIds.push(id);
|
||||||
|
return id;
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\n── Seeding mutual follow on A ──────────────────────────");
|
||||||
|
|
||||||
|
try {
|
||||||
|
await seedFollow({
|
||||||
|
followerId: bob.userId,
|
||||||
|
followingId: alice.userId,
|
||||||
|
followerServerUrl: targetUrl,
|
||||||
|
followingServerUrl: null,
|
||||||
|
});
|
||||||
|
await seedFollow({
|
||||||
|
followerId: alice.userId,
|
||||||
|
followingId: bob.userId,
|
||||||
|
followerServerUrl: null,
|
||||||
|
followingServerUrl: targetUrl,
|
||||||
|
});
|
||||||
|
console.log(` Inserted 2 follow rows pointing at ${targetUrl}.`);
|
||||||
|
} catch (err) {
|
||||||
|
console.error(`Failed to seed follow rows: ${err instanceof Error ? err.message : err}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 4. Alice creates a post on A → expect federation delivery to C.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: post delivery via A API + worker ──────────────");
|
||||||
|
|
||||||
|
const DEFAULT_POST_CONTENT = [{ type: "text" as const, value: "proxy post test" }];
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "POST /api/auth/social/posts → deliver-post job completes";
|
||||||
|
try {
|
||||||
|
console.log(` Alice posting on A; expecting delivery to ${targetPostsUrl}…`);
|
||||||
|
|
||||||
|
const { postId, federationDeliveriesQueued } = await createPostOverHttp(alice, DEFAULT_POST_CONTENT);
|
||||||
|
console.log(` Post created: ${postId}`);
|
||||||
|
console.log(` federationDeliveriesQueued: ${federationDeliveriesQueued}`);
|
||||||
|
|
||||||
|
if (federationDeliveriesQueued < 1) {
|
||||||
|
fail(
|
||||||
|
testName,
|
||||||
|
`expected at least 1 federation delivery, got ${federationDeliveriesQueued}. ` +
|
||||||
|
`Check that the follow rows seeded above point at a server that is in A's registry.`,
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
console.log(" Waiting for the BullMQ worker to deliver FEDERATE_POST to C…");
|
||||||
|
|
||||||
|
// Give the worker a moment to claim the job, then begin polling.
|
||||||
|
await new Promise((r) => setTimeout(r, 300));
|
||||||
|
|
||||||
|
const jobsForPost = await db
|
||||||
|
.select()
|
||||||
|
.from(deliveryJobs)
|
||||||
|
.where(like(deliveryJobs.payload, `%${postId}%`));
|
||||||
|
|
||||||
|
if (jobsForPost.length === 0) {
|
||||||
|
// Already processed before we got to look — that's also success.
|
||||||
|
pass(testName, "delivery job completed before first poll (worker drained immediately)");
|
||||||
|
} else {
|
||||||
|
const forTarget = jobsForPost.filter((j) => j.targetUrl === targetPostsUrl);
|
||||||
|
if (forTarget.length === 0) {
|
||||||
|
const urls = [...new Set(jobsForPost.map((j) => j.targetUrl))].join(", ");
|
||||||
|
fail(
|
||||||
|
testName,
|
||||||
|
`Delivery job(s) target other URL(s): ${urls} — expected ${targetPostsUrl}.`,
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
const maxWait = 60_000;
|
||||||
|
const pollInterval = 2_000;
|
||||||
|
let elapsed = 300;
|
||||||
|
let delivered = false;
|
||||||
|
|
||||||
|
while (elapsed < maxWait) {
|
||||||
|
await new Promise((r) => setTimeout(r, pollInterval));
|
||||||
|
elapsed += pollInterval;
|
||||||
|
|
||||||
|
const pendingJobs = await db
|
||||||
|
.select()
|
||||||
|
.from(deliveryJobs)
|
||||||
|
.where(
|
||||||
|
and(
|
||||||
|
eq(deliveryJobs.targetUrl, targetPostsUrl),
|
||||||
|
like(deliveryJobs.payload, `%${postId}%`),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
.orderBy(desc(deliveryJobs.createdAt))
|
||||||
|
.limit(5);
|
||||||
|
|
||||||
|
process.stdout.write(
|
||||||
|
`\r Polling… ${Math.round(elapsed / 1000)}s — pending jobs for this post: ${pendingJobs.length} `,
|
||||||
|
);
|
||||||
|
|
||||||
|
if (pendingJobs.length === 0) {
|
||||||
|
delivered = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("");
|
||||||
|
|
||||||
|
if (delivered) {
|
||||||
|
pass(testName, "delivery job finished (worker reached C directly or via proxy)");
|
||||||
|
} else {
|
||||||
|
fail(
|
||||||
|
testName,
|
||||||
|
`timed out after ${maxWait / 1000}s with jobs still pending. ` +
|
||||||
|
`Check worker logs (DEBUG=app:federation:*), Redis, and the proxy.`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 5. Optional: no remote followers → createPost still 200 with 0 deliveries.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if (testNoRemoteFollowers) {
|
||||||
|
console.log("\n── Test: createPost 200 + federationDeliveriesQueued === 0 ─");
|
||||||
|
|
||||||
|
const testName = "createPost saves post but queues no federation deliveries";
|
||||||
|
try {
|
||||||
|
// Create a fresh user on A with NO follow rows at all.
|
||||||
|
const solo = await createSipherUser(ORIGIN, { emailPrefix: "solo", usernamePrefix: "solo" });
|
||||||
|
const { federationDeliveriesQueued } = await createPostOverHttp(solo, DEFAULT_POST_CONTENT);
|
||||||
|
|
||||||
|
if (federationDeliveriesQueued === 0) {
|
||||||
|
pass(testName, `post saved with federationDeliveriesQueued=0 (no remote followers)`);
|
||||||
|
} else {
|
||||||
|
fail(
|
||||||
|
testName,
|
||||||
|
`expected federationDeliveriesQueued === 0, got ${federationDeliveriesQueued}.`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Cleanup — drop the rows we seeded so reruns don't accumulate state.
|
||||||
|
// (Users themselves are fine to leave; reruns generate unique emails.)
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
if (createdFollowIds.length > 0) {
|
||||||
|
try {
|
||||||
|
for (const id of createdFollowIds) {
|
||||||
|
await db.delete(follows).where(eq(follows.id, id));
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
console.warn(`(cleanup) failed to drop seeded follows: ${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Summary
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const passed = results.filter((r) => r.passed);
|
||||||
|
const failed = results.filter((r) => !r.passed);
|
||||||
|
|
||||||
|
console.log("\n════════════════════════════════════════════════════════");
|
||||||
|
console.log(`Results: ${passed.length} passed, ${failed.length} failed out of ${results.length}`);
|
||||||
|
|
||||||
|
if (failed.length > 0) {
|
||||||
|
console.error("\nFailed tests:");
|
||||||
|
failed.forEach((f) => console.error(` ✘ ${f.name}: ${f.message}`));
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\nAll tests passed.");
|
||||||
|
process.exit(0);
|
||||||
591
tests/integration/proxy-chain.ts
Normal file
591
tests/integration/proxy-chain.ts
Normal file
|
|
@ -0,0 +1,591 @@
|
||||||
|
/**
|
||||||
|
* Proxy chain integration test.
|
||||||
|
*
|
||||||
|
* Exercises the full A → B → C → B → A proxy relay against real federation
|
||||||
|
* instances. This test focuses on the encrypted-routing layer and uses
|
||||||
|
* `method: "PING"` envelopes so we can validate decrypt + signature + registry
|
||||||
|
* checks without provisioning end-user accounts (post / follow scenarios that
|
||||||
|
* require Better Auth users live in `federation-post-delivery.ts`, which now
|
||||||
|
* auto-creates its own users via Better Auth).
|
||||||
|
*
|
||||||
|
* Run inside the Docker test cluster:
|
||||||
|
*
|
||||||
|
* docker compose -f tests/docker-compose.yml run --rm test-runner \
|
||||||
|
* tests/integration/proxy-chain.ts \
|
||||||
|
* --proxy http://sipher-b:3001 --target http://sipher-c:3002
|
||||||
|
*
|
||||||
|
* `--proxy` and `--target` default to the docker service names if omitted.
|
||||||
|
*
|
||||||
|
* Tests:
|
||||||
|
* 1. Full proxy relay (A → B → C → B → A) round-trips a PING envelope.
|
||||||
|
* 2. Direct TARGETED (A → C) decrypts on C and echoes the nonce.
|
||||||
|
* 3. TARGETED from an unregistered sender → C rejects (sender trust enforced).
|
||||||
|
* 4. PROXY with mismatched signing key → B rejects (key match enforced).
|
||||||
|
* 5. PROXY from an unknown federation origin → B rejects (registry enforced).
|
||||||
|
* 6. Real failover: A's direct fetch to C fails → `federationFetch` falls back
|
||||||
|
* to B as proxy → the round-trip completes through the real proxy code path
|
||||||
|
* on every hop (no stubs, no manually-crafted envelopes from the script).
|
||||||
|
*/
|
||||||
|
|
||||||
|
import { serverRegistry } from "@/lib/db/schema";
|
||||||
|
import { federationFetch } from "@/lib/federation/fetch";
|
||||||
|
import { encryptPayload, fingerprintKey, signMessage } from "@/lib/federation/keytools";
|
||||||
|
import { config } from "dotenv";
|
||||||
|
import { eq } from "drizzle-orm";
|
||||||
|
import { drizzle } from "drizzle-orm/node-postgres";
|
||||||
|
import { Pool } from "pg";
|
||||||
|
import nacl from "tweetnacl";
|
||||||
|
import { createSipherUser } from "../helpers/auth-users";
|
||||||
|
|
||||||
|
config({ path: ".env.local" });
|
||||||
|
|
||||||
|
const FETCH_TIMEOUT_MS = 15_000;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Helpers
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
interface FedKeys {
|
||||||
|
signingPublicKey: string;
|
||||||
|
signingSecretKey: string;
|
||||||
|
encryptionPublicKey: string;
|
||||||
|
encryptionSecretKey: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
function generateEnvKeyPair(): FedKeys {
|
||||||
|
const signing = nacl.sign.keyPair();
|
||||||
|
const encryption = nacl.box.keyPair();
|
||||||
|
return {
|
||||||
|
signingPublicKey: Buffer.from(signing.publicKey).toString("base64"),
|
||||||
|
signingSecretKey: Buffer.from(signing.secretKey).toString("base64"),
|
||||||
|
encryptionPublicKey: Buffer.from(encryption.publicKey).toString("base64"),
|
||||||
|
encryptionSecretKey: Buffer.from(encryption.secretKey).toString("base64"),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
async function readErrorBody(response: Response): Promise<string> {
|
||||||
|
try {
|
||||||
|
const body = await response.json();
|
||||||
|
return body?.error ?? body?.message ?? JSON.stringify(body);
|
||||||
|
} catch {
|
||||||
|
try {
|
||||||
|
return await response.text();
|
||||||
|
} catch {
|
||||||
|
return response.statusText;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
interface TestResult {
|
||||||
|
name: string;
|
||||||
|
passed: boolean;
|
||||||
|
message: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
const results: TestResult[] = [];
|
||||||
|
|
||||||
|
function pass(name: string, message = "OK") {
|
||||||
|
console.log(` ✔ ${name}`);
|
||||||
|
if (message !== "OK") console.log(` ${message}`);
|
||||||
|
results.push({ name, passed: true, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
function fail(name: string, message: string) {
|
||||||
|
console.error(` ✘ ${name}`);
|
||||||
|
console.error(` ${message}`);
|
||||||
|
results.push({ name, passed: false, message });
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Validate environment
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const REQUIRED_ENV = [
|
||||||
|
"FEDERATION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_PRIVATE_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PUBLIC_KEY",
|
||||||
|
"FEDERATION_ENCRYPTION_PRIVATE_KEY",
|
||||||
|
"BETTER_AUTH_URL",
|
||||||
|
] as const;
|
||||||
|
|
||||||
|
const missing = REQUIRED_ENV.filter((k) => !process.env[k]);
|
||||||
|
if (missing.length > 0) {
|
||||||
|
console.error("Missing required environment variables:");
|
||||||
|
missing.forEach((k) => console.error(` - ${k}`));
|
||||||
|
console.error("Run inside the docker test cluster (env_file: tests/docker/sipher-a.env).");
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const ORIGIN = process.env.BETTER_AUTH_URL!;
|
||||||
|
const OWN_SIGNING_PUB = process.env.FEDERATION_PUBLIC_KEY!;
|
||||||
|
const OWN_ENCRYPTION_PUB = process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!;
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Parse arguments
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function argAfter(flag: string): string | undefined {
|
||||||
|
const idx = process.argv.indexOf(flag);
|
||||||
|
return idx !== -1 ? process.argv[idx + 1] : undefined;
|
||||||
|
}
|
||||||
|
|
||||||
|
const proxyUrl = argAfter("--proxy") ?? "http://sipher-b:3001";
|
||||||
|
const targetUrl = argAfter("--target") ?? "http://sipher-c:3002";
|
||||||
|
|
||||||
|
console.log("Proxy chain test");
|
||||||
|
console.log(` Server A (us): ${ORIGIN}`);
|
||||||
|
console.log(` Server B (proxy): ${proxyUrl}`);
|
||||||
|
console.log(` Server C (target): ${targetUrl}`);
|
||||||
|
console.log(` A signing key: ${fingerprintKey(OWN_SIGNING_PUB).slice(0, 16)}…`);
|
||||||
|
console.log(` A encryption key: ${fingerprintKey(OWN_ENCRYPTION_PUB).slice(0, 16)}…`);
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 1. Discovery check
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
interface DiscoverResponse {
|
||||||
|
url: string;
|
||||||
|
publicKey: string;
|
||||||
|
encryptionPublicKey: string;
|
||||||
|
peers: { url: string; isHealthy: boolean }[];
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\n── Discovery ────────────────────────────────────────────");
|
||||||
|
|
||||||
|
async function fetchDiscover(url: string, label: string): Promise<DiscoverResponse> {
|
||||||
|
try {
|
||||||
|
const res = await fetch(`${url}/discover`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
|
||||||
|
if (!res.ok) {
|
||||||
|
console.error(`${label} (${url}) returned ${res.status}: ${await readErrorBody(res)}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
const body = (await res.json()) as DiscoverResponse;
|
||||||
|
console.log(` ${label}: ${body.url}`);
|
||||||
|
console.log(` signing: ${fingerprintKey(body.publicKey).slice(0, 16)}…`);
|
||||||
|
console.log(` encryption: ${fingerprintKey(body.encryptionPublicKey).slice(0, 16)}…`);
|
||||||
|
console.log(` peers: ${body.peers.length}`);
|
||||||
|
return body;
|
||||||
|
} catch (err) {
|
||||||
|
console.error(`Cannot reach ${label} at ${url}/discover: ${err instanceof Error ? err.message : err}`);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const proxyInfo = await fetchDiscover(proxyUrl, "B");
|
||||||
|
const targetInfo = await fetchDiscover(targetUrl, "C");
|
||||||
|
|
||||||
|
const aOnB = proxyInfo.peers.some((p) => p.url === ORIGIN);
|
||||||
|
const aOnC = targetInfo.peers.some((p) => p.url === ORIGIN);
|
||||||
|
console.log(` A registered on B: ${aOnB}`);
|
||||||
|
console.log(` A registered on C: ${aOnC}`);
|
||||||
|
|
||||||
|
if (!aOnB || !aOnC) {
|
||||||
|
console.error(
|
||||||
|
"\n A is not registered on at least one peer. Run mutual discovery first:\n" +
|
||||||
|
" docker compose -f tests/docker-compose.yml --profile setup up",
|
||||||
|
);
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 2. Full proxy relay: A → B → C → B → A
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: Full proxy relay (A → B → C → B → A) ─────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "full proxy relay";
|
||||||
|
try {
|
||||||
|
const nonce = crypto.randomUUID();
|
||||||
|
// Encrypt a PING payload with C's public key so C can decrypt and verify
|
||||||
|
// the full A→B→C→B→A crypto routing without needing real user data.
|
||||||
|
const innerPayload = JSON.stringify({ method: "PING", nonce, sender: ORIGIN });
|
||||||
|
|
||||||
|
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
||||||
|
|
||||||
|
const proxyBody = {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: targetUrl + "/proxy",
|
||||||
|
publicSigningKey: OWN_SIGNING_PUB,
|
||||||
|
publicEncryptionKey: OWN_ENCRYPTION_PUB,
|
||||||
|
payload: encrypted,
|
||||||
|
};
|
||||||
|
|
||||||
|
const res = await fetch(`${proxyUrl}/proxy`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": ORIGIN,
|
||||||
|
"Origin": ORIGIN,
|
||||||
|
},
|
||||||
|
body: JSON.stringify(proxyBody),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
|
||||||
|
if (res.status !== 200) {
|
||||||
|
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
} else if (body.method !== "PROXY_RESPONSE") {
|
||||||
|
fail(testName, `expected method=PROXY_RESPONSE, got ${body.method}`);
|
||||||
|
} else if (!body.payload) {
|
||||||
|
fail(testName, "response missing payload (B did not relay C's response)");
|
||||||
|
} else if (body.payload.method !== "PROXY_RESPONSE") {
|
||||||
|
fail(testName, `inner payload method=${body.payload.method}, expected PROXY_RESPONSE`);
|
||||||
|
} else if (body.payload.nonce !== nonce) {
|
||||||
|
fail(testName, `nonce mismatch: sent ${nonce}, C echoed ${body.payload.nonce}`);
|
||||||
|
} else {
|
||||||
|
pass(testName, `nonce round-trip OK (${nonce})`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 3. Direct TARGETED: A → C
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: Direct TARGETED (A → C) ────────────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "direct TARGETED to C";
|
||||||
|
try {
|
||||||
|
const nonce = crypto.randomUUID();
|
||||||
|
const innerPayload = JSON.stringify({ method: "PING", nonce, sender: ORIGIN });
|
||||||
|
|
||||||
|
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
||||||
|
|
||||||
|
const res = await fetch(`${targetUrl}/proxy`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": ORIGIN,
|
||||||
|
"Origin": ORIGIN,
|
||||||
|
},
|
||||||
|
body: JSON.stringify({
|
||||||
|
method: "TARGETED",
|
||||||
|
payload: encrypted,
|
||||||
|
}),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
|
||||||
|
if (res.status !== 200) {
|
||||||
|
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
||||||
|
} else if (body.method !== "PROXY_RESPONSE") {
|
||||||
|
fail(testName, `expected method=PROXY_RESPONSE, got ${body.method}`);
|
||||||
|
} else if (body.nonce !== nonce) {
|
||||||
|
fail(testName, `nonce mismatch: sent ${nonce}, C echoed ${body.nonce}`);
|
||||||
|
} else {
|
||||||
|
pass(testName, `nonce round-trip OK (${nonce}), C status: ${body.status}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 4. TARGETED rejection — unregistered sender → C
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: TARGETED from unregistered sender → C ─────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "reject unregistered TARGETED sender";
|
||||||
|
try {
|
||||||
|
const fakeOrigin = "https://totally-unknown-federation-" + crypto.randomUUID().slice(0, 8) + ".test";
|
||||||
|
const innerPayload = JSON.stringify({ method: "PING", nonce: crypto.randomUUID() });
|
||||||
|
|
||||||
|
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
||||||
|
|
||||||
|
const res = await fetch(`${targetUrl}/proxy`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": fakeOrigin,
|
||||||
|
"Origin": fakeOrigin,
|
||||||
|
},
|
||||||
|
body: JSON.stringify({
|
||||||
|
method: "TARGETED",
|
||||||
|
payload: encrypted,
|
||||||
|
}),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
|
||||||
|
if (res.status === 403 && body.code === "UNKNOWN_FEDERATION_SERVER_INTERACTION") {
|
||||||
|
pass(testName, `C correctly rejected: "${body.error}"`);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 403/UNKNOWN_FEDERATION_SERVER_INTERACTION, got ${res.status}/${body.code}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 5. Sender validation — bad signing key
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: Sender validation (bad keys → B) ──────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "reject mismatched signing key";
|
||||||
|
try {
|
||||||
|
const fakeKeys = generateEnvKeyPair();
|
||||||
|
|
||||||
|
const innerPayload = JSON.stringify({ method: "PING", nonce: crypto.randomUUID() });
|
||||||
|
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
||||||
|
|
||||||
|
const proxyBody = {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: targetUrl + "/proxy",
|
||||||
|
publicSigningKey: fakeKeys.signingPublicKey,
|
||||||
|
publicEncryptionKey: OWN_ENCRYPTION_PUB,
|
||||||
|
payload: encrypted,
|
||||||
|
};
|
||||||
|
|
||||||
|
const res = await fetch(`${proxyUrl}/proxy`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": ORIGIN,
|
||||||
|
"Origin": ORIGIN,
|
||||||
|
},
|
||||||
|
body: JSON.stringify(proxyBody),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
|
||||||
|
if (res.status === 403 && body.code === "INCORRECT_KEYS") {
|
||||||
|
pass(testName, `B correctly rejected: "${body.error}"`);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 403/INCORRECT_KEYS, got ${res.status}/${body.code}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 6. Unknown sender
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: Unknown sender (→ B) ────────────────────────────");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "reject unknown sender";
|
||||||
|
try {
|
||||||
|
const unknownKeys = generateEnvKeyPair();
|
||||||
|
const unknownOrigin = "https://totally-unknown-federation-" + crypto.randomUUID().slice(0, 8) + ".test";
|
||||||
|
|
||||||
|
const innerPayload = JSON.stringify({ method: "PING", nonce: crypto.randomUUID() });
|
||||||
|
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
||||||
|
|
||||||
|
const proxyBody = {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: targetUrl + "/proxy",
|
||||||
|
publicSigningKey: unknownKeys.signingPublicKey,
|
||||||
|
publicEncryptionKey: unknownKeys.encryptionPublicKey,
|
||||||
|
payload: encrypted,
|
||||||
|
};
|
||||||
|
|
||||||
|
const res = await fetch(`${proxyUrl}/proxy`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": unknownOrigin,
|
||||||
|
"Origin": unknownOrigin,
|
||||||
|
},
|
||||||
|
body: JSON.stringify(proxyBody),
|
||||||
|
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
||||||
|
});
|
||||||
|
|
||||||
|
const body = await res.json();
|
||||||
|
|
||||||
|
if (res.status === 403 && body.code === "UNKNOWN_FEDERATION_SERVER_INTERACTION") {
|
||||||
|
pass(testName, `B correctly rejected: "${body.error}"`);
|
||||||
|
} else {
|
||||||
|
fail(testName, `expected 403/UNKNOWN_FEDERATION_SERVER_INTERACTION, got ${res.status}/${body.code}: ${JSON.stringify(body)}`);
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// 7. Real failover via federationFetch
|
||||||
|
//
|
||||||
|
// Drives the full failover code path on A's side — not a manually crafted
|
||||||
|
// PROXY envelope from the test script. We invoke A's actual
|
||||||
|
// `federationFetch(url, { serverUrl, proxyFallback: true, ... })` against a
|
||||||
|
// deliberately unreachable hostname so the direct call fails with
|
||||||
|
// `DNS_BLOCKED` (the proxy-eligible failure class in the threat model). That
|
||||||
|
// triggers the proxy fallback, which:
|
||||||
|
//
|
||||||
|
// • picks B as a healthy proxy via the registry
|
||||||
|
// • encrypts the request to C's encryption key
|
||||||
|
// • POSTs a PROXY envelope to B (real B, with real signing/registry checks)
|
||||||
|
// • B forwards it as TARGETED to C (real C, full schema + signature checks)
|
||||||
|
// • C processes a real FEDERATE_FOLLOW with users that exist on both servers
|
||||||
|
//
|
||||||
|
// The round-trip ack comes back through B verbatim, proving the entire flow
|
||||||
|
// works without stubs, without script-crafted envelopes, and with the real
|
||||||
|
// failover trigger in `federationFetch`.
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
console.log("\n── Test: real failover (A → C direct FAILS → A → B → C proxy SUCCEEDS) ─");
|
||||||
|
|
||||||
|
{
|
||||||
|
const testName = "real failover via federationFetch";
|
||||||
|
// `sipher-unreachable.test` is allow-listed in DEV_ALLOWED_HOSTNAMES (so
|
||||||
|
// url-guard passes) but does not resolve via Docker DNS, producing
|
||||||
|
// ENOTFOUND → UNKNOWN/DNS_BLOCKED → proxy-eligible per the threat model.
|
||||||
|
// The path `/api/auth/social/follows` matters because C's TARGETED router
|
||||||
|
// branches on it to dispatch FEDERATE_FOLLOW.
|
||||||
|
const sabotagedUrl = "http://sipher-unreachable.test:9999/api/auth/social/follows";
|
||||||
|
const sabotagedOrigin = new URL(sabotagedUrl).origin;
|
||||||
|
|
||||||
|
// `attemptProxyRoute` puts the original failing URL into the inner
|
||||||
|
// encrypted payload (`innerPayload.targetUrl = url`). When C processes the
|
||||||
|
// FEDERATE_FOLLOW, it derives `following_server_url` from that URL — and
|
||||||
|
// the `follows.following_server_url` column has an FK to server_registry.
|
||||||
|
// In production both A and B would be reaching the *same* real URL for C,
|
||||||
|
// so the FK target is already in C's registry. Our test deliberately
|
||||||
|
// breaks A's path while keeping B's path intact, so we seed the sabotaged
|
||||||
|
// URL as a placeholder registry row on C just to satisfy the FK. The keys
|
||||||
|
// are dummies — they're never used (sender validation runs against A's
|
||||||
|
// real keys via X-Federation-Origin).
|
||||||
|
const cDbUrl = process.env.DATABASE_URL!.replace(/\/sipher_a(\?|$)/, "/sipher_c$1");
|
||||||
|
const cPool = new Pool({ connectionString: cDbUrl });
|
||||||
|
const cDb = drizzle(cPool, { schema: { serverRegistry } });
|
||||||
|
const dummyKeys = generateEnvKeyPair();
|
||||||
|
try {
|
||||||
|
await cDb.insert(serverRegistry).values({
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
url: sabotagedOrigin,
|
||||||
|
publicKey: dummyKeys.signingPublicKey,
|
||||||
|
encryptionPublicKey: dummyKeys.encryptionPublicKey,
|
||||||
|
lastSeen: new Date(),
|
||||||
|
createdAt: new Date(),
|
||||||
|
updatedAt: new Date(),
|
||||||
|
isHealthy: true,
|
||||||
|
}).onConflictDoNothing();
|
||||||
|
|
||||||
|
console.log(" Provisioning Alice on A and Bob on C…");
|
||||||
|
const alice = await createSipherUser(ORIGIN, {
|
||||||
|
emailPrefix: "alice-failover",
|
||||||
|
usernamePrefix: "alice_fo",
|
||||||
|
});
|
||||||
|
const bob = await createSipherUser(targetUrl, {
|
||||||
|
emailPrefix: "bob-failover",
|
||||||
|
usernamePrefix: "bob_fo",
|
||||||
|
});
|
||||||
|
console.log(` Alice: ${alice.userId} Bob: ${bob.userId}`);
|
||||||
|
|
||||||
|
// Build the FEDERATE follow body C will ultimately receive after the
|
||||||
|
// proxy hop. Inner is signed by A so C's signature check passes, and
|
||||||
|
// encrypted to C's encryption key so only C can decrypt the envelope.
|
||||||
|
const innerFollow = {
|
||||||
|
following: {
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
createdAt: new Date().toISOString(),
|
||||||
|
followerId: alice.userId,
|
||||||
|
followingId: bob.userId,
|
||||||
|
accepted: false,
|
||||||
|
followerServerUrl: ORIGIN,
|
||||||
|
},
|
||||||
|
federationUrl: ORIGIN,
|
||||||
|
method: "FEDERATE" as const,
|
||||||
|
};
|
||||||
|
const innerRaw = JSON.stringify(innerFollow);
|
||||||
|
const aSigningSecret = new Uint8Array(
|
||||||
|
Buffer.from(process.env.FEDERATION_PRIVATE_KEY!, "base64"),
|
||||||
|
);
|
||||||
|
const signature = signMessage(innerRaw, aSigningSecret);
|
||||||
|
const cEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
||||||
|
const followEnvelope = encryptPayload(innerRaw, cEncKey);
|
||||||
|
|
||||||
|
const fedRequestBody = JSON.stringify({
|
||||||
|
method: "FEDERATE",
|
||||||
|
payload: followEnvelope,
|
||||||
|
signature,
|
||||||
|
});
|
||||||
|
|
||||||
|
const result = await federationFetch(sabotagedUrl, {
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": ORIGIN,
|
||||||
|
"X-Federation-Target": sabotagedUrl,
|
||||||
|
"Origin": ORIGIN,
|
||||||
|
},
|
||||||
|
body: fedRequestBody,
|
||||||
|
// Overrides `extractServerUrl` so the proxy peer forwards to C's
|
||||||
|
// real URL, not the sabotaged one — proves that the real C URL is
|
||||||
|
// what the proxy chain uses.
|
||||||
|
serverUrl: targetUrl,
|
||||||
|
proxyFallback: true,
|
||||||
|
timeout: 20_000,
|
||||||
|
});
|
||||||
|
|
||||||
|
if (!result.proxied) {
|
||||||
|
fail(testName, "federationFetch did NOT use proxy — the direct call to sipher-unreachable.test must have unexpectedly succeeded");
|
||||||
|
} else if (!result.response.ok) {
|
||||||
|
fail(testName, `proxy response status=${result.response.status}: ${await readErrorBody(result.response)}`);
|
||||||
|
} else {
|
||||||
|
const body = await result.response.json();
|
||||||
|
if (body.method !== "PROXY_RESPONSE") {
|
||||||
|
fail(testName, `expected method=PROXY_RESPONSE, got ${body.method}`);
|
||||||
|
} else if (!body.payload) {
|
||||||
|
fail(testName, "expected outer PROXY_RESPONSE.payload from B (relay envelope missing)");
|
||||||
|
} else if (body.payload.method !== "PROXY_RESPONSE") {
|
||||||
|
fail(testName, `expected payload.method=PROXY_RESPONSE from C, got ${body.payload?.method}`);
|
||||||
|
} else if (body.payload.status !== "acknowledged") {
|
||||||
|
fail(testName, `expected payload.status=acknowledged from C, got ${body.payload?.status}`);
|
||||||
|
} else {
|
||||||
|
pass(
|
||||||
|
testName,
|
||||||
|
`A → ${result.proxyPeer} (proxy) → ${targetUrl} succeeded after direct failed; ack from C carried back through B`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} catch (err) {
|
||||||
|
fail(testName, `${err instanceof Error ? err.message : err}`);
|
||||||
|
} finally {
|
||||||
|
try {
|
||||||
|
await cDb.delete(serverRegistry).where(eq(serverRegistry.url, sabotagedOrigin));
|
||||||
|
} catch (cleanupErr) {
|
||||||
|
console.warn(` (cleanup) could not remove fake server row: ${cleanupErr instanceof Error ? cleanupErr.message : cleanupErr}`);
|
||||||
|
}
|
||||||
|
await cPool.end();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
// Summary
|
||||||
|
// ---------------------------------------------------------------------------
|
||||||
|
|
||||||
|
const passed = results.filter((r) => r.passed);
|
||||||
|
const failed = results.filter((r) => !r.passed);
|
||||||
|
|
||||||
|
console.log("\n════════════════════════════════════════════════════════");
|
||||||
|
console.log(`Results: ${passed.length} passed, ${failed.length} failed out of ${results.length}`);
|
||||||
|
|
||||||
|
if (failed.length > 0) {
|
||||||
|
console.error("\nFailed tests:");
|
||||||
|
failed.forEach((f) => console.error(` ✘ ${f.name}: ${f.message}`));
|
||||||
|
process.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log("\nAll tests passed.");
|
||||||
|
process.exit(0);
|
||||||
|
|
@ -1,279 +0,0 @@
|
||||||
/**
|
|
||||||
* Tests the key rotation flow.
|
|
||||||
*
|
|
||||||
* This test covers:
|
|
||||||
* - Init endpoint: validation, not-found, duplicate challenge
|
|
||||||
* - Missing challenge on confirm
|
|
||||||
* - Expired challenge on confirm
|
|
||||||
* - Wrong challenge proofs (full init → confirm flow)
|
|
||||||
* - Blacklists server after too many failed attempts
|
|
||||||
* - Full init → confirm happy path that rotates both keys
|
|
||||||
*/
|
|
||||||
import type { EncryptedEnvelope } from "@/lib/federation/keytools"
|
|
||||||
import { decryptPayload, encryptPayload, signMessage } from "@/lib/federation/keytools"
|
|
||||||
import { expect, test } from "@playwright/test"
|
|
||||||
import createDebug from "debug"
|
|
||||||
import { clearTables, generateEnvKeyPair, getServerByUrl, seedChallenge, seedServer } from "./helpers/db"
|
|
||||||
|
|
||||||
const debug = createDebug("test:key")
|
|
||||||
|
|
||||||
const SERVER_URL = "https://test-server.com"
|
|
||||||
|
|
||||||
test.beforeEach(async ({ }, testInfo) => {
|
|
||||||
debug("beforeEach – clearing tables for: %s", testInfo.title)
|
|
||||||
await clearTables()
|
|
||||||
})
|
|
||||||
test.afterEach(async ({ }, testInfo) => {
|
|
||||||
debug("afterEach – clearing tables after: %s", testInfo.title)
|
|
||||||
await clearTables()
|
|
||||||
})
|
|
||||||
|
|
||||||
function getOwnEncryptionPublicKey(): Uint8Array {
|
|
||||||
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"))
|
|
||||||
}
|
|
||||||
|
|
||||||
function buildBadEnvelope() {
|
|
||||||
return encryptPayload(
|
|
||||||
JSON.stringify({
|
|
||||||
signingOldSignature: "wrong",
|
|
||||||
signingNewSignature: "wrong",
|
|
||||||
encryptionOldPlaintext: "wrong",
|
|
||||||
encryptionNewPlaintext: "wrong",
|
|
||||||
}),
|
|
||||||
getOwnEncryptionPublicKey(),
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
interface InitChallenges {
|
|
||||||
signingOldChallenge: string
|
|
||||||
signingNewChallenge: string
|
|
||||||
encryptionOldChallenge: EncryptedEnvelope
|
|
||||||
encryptionNewChallenge: EncryptedEnvelope
|
|
||||||
}
|
|
||||||
|
|
||||||
function solveInitChallenges(
|
|
||||||
challenges: InitChallenges,
|
|
||||||
oldKeys: ReturnType<typeof generateEnvKeyPair>,
|
|
||||||
newKeys: ReturnType<typeof generateEnvKeyPair>,
|
|
||||||
) {
|
|
||||||
const oldSigningSecret = new Uint8Array(Buffer.from(oldKeys.signingSecretKey, "base64"))
|
|
||||||
const newSigningSecret = new Uint8Array(Buffer.from(newKeys.signingSecretKey, "base64"))
|
|
||||||
const oldEncSecret = new Uint8Array(Buffer.from(oldKeys.encryptionSecretKey, "base64"))
|
|
||||||
const newEncSecret = new Uint8Array(Buffer.from(newKeys.encryptionSecretKey, "base64"))
|
|
||||||
|
|
||||||
return {
|
|
||||||
signingOldSignature: signMessage(challenges.signingOldChallenge, oldSigningSecret),
|
|
||||||
signingNewSignature: signMessage(challenges.signingNewChallenge, newSigningSecret),
|
|
||||||
encryptionOldPlaintext: decryptPayload(challenges.encryptionOldChallenge, oldEncSecret),
|
|
||||||
encryptionNewPlaintext: decryptPayload(challenges.encryptionNewChallenge, newEncSecret),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// rotate/init tests
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test("init rejects unregistered server", async ({ request }) => {
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
const res = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: "https://unknown-server.com",
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(404)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("init rejects same keys as currently registered", async ({ request }) => {
|
|
||||||
const keys = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, keys.signingPublicKey, keys.encryptionPublicKey)
|
|
||||||
const res = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: keys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: keys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
expect(await res.json()).toMatchObject({ error: /already registered/i })
|
|
||||||
})
|
|
||||||
|
|
||||||
test("init issues 4 challenges", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const res = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(200)
|
|
||||||
|
|
||||||
const body = await res.json()
|
|
||||||
expect(body.signingOldChallenge).toBeDefined()
|
|
||||||
expect(body.signingNewChallenge).toBeDefined()
|
|
||||||
expect(body.encryptionOldChallenge).toBeDefined()
|
|
||||||
expect(body.encryptionOldChallenge.ephemeralPublicKey).toBeDefined()
|
|
||||||
expect(body.encryptionNewChallenge).toBeDefined()
|
|
||||||
expect(body.encryptionNewChallenge.ephemeralPublicKey).toBeDefined()
|
|
||||||
})
|
|
||||||
|
|
||||||
test("init rejects duplicate while challenge is pending", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const newKeys1 = generateEnvKeyPair()
|
|
||||||
const newKeys2 = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
|
|
||||||
const res1 = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys1.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys1.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res1.status()).toBe(200)
|
|
||||||
|
|
||||||
const res2 = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys2.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys2.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res2.status()).toBe(409)
|
|
||||||
expect(await res2.json()).toMatchObject({ error: /already pending/i })
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// rotate/confirm tests
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test("confirm rejects missing challenge", async ({ request }) => {
|
|
||||||
const res = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: "https://ghost-server.com",
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(404)
|
|
||||||
})
|
|
||||||
|
|
||||||
test("confirm rejects expired challenge", async ({ request }) => {
|
|
||||||
await seedChallenge({ expiresAt: new Date(Date.now() - 1000) })
|
|
||||||
const res = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: SERVER_URL,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
expect(await res.json()).toMatchObject({ error: /expired/ })
|
|
||||||
})
|
|
||||||
|
|
||||||
test("confirm rejects wrong proofs (init → confirm)", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
|
|
||||||
debug("test: wrong proofs – calling init")
|
|
||||||
const initRes = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(initRes.status()).toBe(200)
|
|
||||||
|
|
||||||
debug("test: wrong proofs – confirming with garbage proofs")
|
|
||||||
const confirmRes = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: SERVER_URL,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(confirmRes.status()).toBe(400)
|
|
||||||
expect(await confirmRes.json()).toMatchObject({ error: /failed/i })
|
|
||||||
})
|
|
||||||
|
|
||||||
test("confirm blacklists after too many failed attempts", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
|
|
||||||
debug("test: blacklists – calling init")
|
|
||||||
const initRes = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(initRes.status()).toBe(200)
|
|
||||||
|
|
||||||
for (let i = 0; i < 3; i++) {
|
|
||||||
debug("test: blacklists – wrong attempt %d/3", i + 1)
|
|
||||||
const res = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: SERVER_URL,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(res.status()).toBe(400)
|
|
||||||
expect(await res.json()).toMatchObject({ error: /failed/i })
|
|
||||||
}
|
|
||||||
|
|
||||||
debug("test: blacklists – 4th attempt triggers blacklist")
|
|
||||||
const finalRes = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: SERVER_URL,
|
|
||||||
envelope: buildBadEnvelope(),
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(finalRes.status()).toBe(403)
|
|
||||||
expect(await finalRes.json()).toMatchObject({ error: /blacklisted/ })
|
|
||||||
})
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Full init → confirm happy path
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
test("full rotation flow: init → solve → confirm rotates both keys", async ({ request }) => {
|
|
||||||
const oldKeys = generateEnvKeyPair()
|
|
||||||
const newKeys = generateEnvKeyPair()
|
|
||||||
await seedServer(SERVER_URL, oldKeys.signingPublicKey, oldKeys.encryptionPublicKey)
|
|
||||||
|
|
||||||
debug("test: full flow – calling init")
|
|
||||||
const initRes = await request.post("/discover/rotate/init", {
|
|
||||||
data: {
|
|
||||||
url: SERVER_URL,
|
|
||||||
newSigningPublicKey: newKeys.signingPublicKey,
|
|
||||||
newEncryptionPublicKey: newKeys.encryptionPublicKey,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(initRes.status()).toBe(200)
|
|
||||||
const challenges: InitChallenges = await initRes.json()
|
|
||||||
|
|
||||||
debug("test: full flow – solving challenges")
|
|
||||||
const proofs = solveInitChallenges(challenges, oldKeys, newKeys)
|
|
||||||
|
|
||||||
debug("test: full flow – building proof envelope encrypted with SA's X25519 key")
|
|
||||||
const envelope = encryptPayload(JSON.stringify(proofs), getOwnEncryptionPublicKey())
|
|
||||||
|
|
||||||
debug("test: full flow – confirming")
|
|
||||||
const confirmRes = await request.post("/discover/rotate/confirm", {
|
|
||||||
data: {
|
|
||||||
serverUrl: SERVER_URL,
|
|
||||||
envelope,
|
|
||||||
}
|
|
||||||
})
|
|
||||||
expect(confirmRes.status()).toBe(200)
|
|
||||||
expect(await confirmRes.json()).toMatchObject({ message: /confirmed/ })
|
|
||||||
|
|
||||||
debug("test: full flow – verifying keys were rotated in DB")
|
|
||||||
const server = await getServerByUrl(SERVER_URL)
|
|
||||||
expect(server).toBeDefined()
|
|
||||||
expect(server!.publicKey).toBe(newKeys.signingPublicKey)
|
|
||||||
expect(server!.encryptionPublicKey).toBe(newKeys.encryptionPublicKey)
|
|
||||||
})
|
|
||||||
|
|
@ -1,596 +0,0 @@
|
||||||
/**
|
|
||||||
* Manual proxy chain test script.
|
|
||||||
*
|
|
||||||
* You need 3 different instances up and running to use this test script. That includes yours.
|
|
||||||
*
|
|
||||||
* Exercises the full A → B → C → B → A proxy relay against real federation
|
|
||||||
* instances. Run this from Server A while Server B (proxy) and Server C
|
|
||||||
* (target) are already up.
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* bun run testProxy.ts --proxy <B_URL> --target <C_URL>
|
|
||||||
*
|
|
||||||
* Examples:
|
|
||||||
* bun run testProxy.ts --proxy https://proxy.example.com --target https://target.example.com
|
|
||||||
* bun run testProxy.ts --proxy http://localhost:3001 --target http://localhost:3002
|
|
||||||
*/
|
|
||||||
|
|
||||||
import db from "@/lib/db";
|
|
||||||
import { deliveryJobs, follows, serverRegistry } from "@/lib/db/schema";
|
|
||||||
import { encryptPayload, fingerprintKey, signMessage } from "@/lib/federation/keytools";
|
|
||||||
import { config } from "dotenv";
|
|
||||||
import { desc, eq } from "drizzle-orm";
|
|
||||||
import nacl from "tweetnacl";
|
|
||||||
|
|
||||||
config({ path: ".env.local" });
|
|
||||||
|
|
||||||
const FETCH_TIMEOUT_MS = 15_000;
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Helpers
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
interface FedKeys {
|
|
||||||
signingPublicKey: string;
|
|
||||||
signingSecretKey: string;
|
|
||||||
encryptionPublicKey: string;
|
|
||||||
encryptionSecretKey: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateEnvKeyPair(): FedKeys {
|
|
||||||
const signing = nacl.sign.keyPair();
|
|
||||||
const encryption = nacl.box.keyPair();
|
|
||||||
return {
|
|
||||||
signingPublicKey: Buffer.from(signing.publicKey).toString("base64"),
|
|
||||||
signingSecretKey: Buffer.from(signing.secretKey).toString("base64"),
|
|
||||||
encryptionPublicKey: Buffer.from(encryption.publicKey).toString("base64"),
|
|
||||||
encryptionSecretKey: Buffer.from(encryption.secretKey).toString("base64"),
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
async function readErrorBody(response: Response): Promise<string> {
|
|
||||||
try {
|
|
||||||
const body = await response.json();
|
|
||||||
return body?.error ?? body?.message ?? JSON.stringify(body);
|
|
||||||
} catch {
|
|
||||||
try {
|
|
||||||
return await response.text();
|
|
||||||
} catch {
|
|
||||||
return response.statusText;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
interface TestResult {
|
|
||||||
name: string;
|
|
||||||
passed: boolean;
|
|
||||||
message: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
const results: TestResult[] = [];
|
|
||||||
|
|
||||||
function pass(name: string, message = "OK") {
|
|
||||||
console.log(` ✔ ${name}`);
|
|
||||||
if (message !== "OK") console.log(` ${message}`);
|
|
||||||
results.push({ name, passed: true, message });
|
|
||||||
}
|
|
||||||
|
|
||||||
function fail(name: string, message: string) {
|
|
||||||
console.error(` ✘ ${name}`);
|
|
||||||
console.error(` ${message}`);
|
|
||||||
results.push({ name, passed: false, message });
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Validate environment
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
const REQUIRED_ENV = [
|
|
||||||
"FEDERATION_PUBLIC_KEY",
|
|
||||||
"FEDERATION_PRIVATE_KEY",
|
|
||||||
"FEDERATION_ENCRYPTION_PUBLIC_KEY",
|
|
||||||
"FEDERATION_ENCRYPTION_PRIVATE_KEY",
|
|
||||||
"BETTER_AUTH_URL",
|
|
||||||
] as const;
|
|
||||||
|
|
||||||
const missing = REQUIRED_ENV.filter((k) => !process.env[k]);
|
|
||||||
if (missing.length > 0) {
|
|
||||||
console.error("Missing required environment variables:");
|
|
||||||
missing.forEach((k) => console.error(` - ${k}`));
|
|
||||||
console.error("Ensure .env.local is present and populated.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
const ORIGIN = process.env.BETTER_AUTH_URL!;
|
|
||||||
const OWN_SIGNING_PUB = process.env.FEDERATION_PUBLIC_KEY!;
|
|
||||||
const OWN_ENCRYPTION_PUB = process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!;
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Parse arguments
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
function argAfter(flag: string): string | undefined {
|
|
||||||
const idx = process.argv.indexOf(flag);
|
|
||||||
return idx !== -1 ? process.argv[idx + 1] : undefined;
|
|
||||||
}
|
|
||||||
|
|
||||||
const proxyUrl = argAfter("--proxy");
|
|
||||||
const targetUrl = argAfter("--target");
|
|
||||||
const bearerToken = argAfter("--bearer");
|
|
||||||
const targetUserId = argAfter("--user");
|
|
||||||
|
|
||||||
if (!proxyUrl || !targetUrl) {
|
|
||||||
console.error("Usage: bun run testProxy.ts --proxy <B_URL> --target <C_URL> [options]");
|
|
||||||
console.error("");
|
|
||||||
console.error(" --proxy URL of Server B (the proxy)");
|
|
||||||
console.error(" --target URL of Server C (the target)");
|
|
||||||
console.error(" --test-fallback Enable proxy fallback test (requires C blocked from A)");
|
|
||||||
console.error(" --bearer <tok> Bearer token for A's API (required for --test-fallback)");
|
|
||||||
console.error(" --user <id> User ID on Server C to follow (required for --test-fallback)");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("Proxy chain test");
|
|
||||||
console.log(` Server A (us): ${ORIGIN}`);
|
|
||||||
console.log(` Server B (proxy): ${proxyUrl}`);
|
|
||||||
console.log(` Server C (target): ${targetUrl}`);
|
|
||||||
console.log(` A signing key: ${fingerprintKey(OWN_SIGNING_PUB).slice(0, 16)}…`);
|
|
||||||
console.log(` A encryption key: ${fingerprintKey(OWN_ENCRYPTION_PUB).slice(0, 16)}…`);
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 1. Discovery check
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
interface DiscoverResponse {
|
|
||||||
url: string;
|
|
||||||
publicKey: string;
|
|
||||||
encryptionPublicKey: string;
|
|
||||||
peers: { url: string; isHealthy: boolean }[];
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("\n── Discovery ────────────────────────────────────────────");
|
|
||||||
|
|
||||||
let proxyInfo: DiscoverResponse;
|
|
||||||
let targetInfo: DiscoverResponse;
|
|
||||||
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${proxyUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
if (!res.ok) {
|
|
||||||
console.error(`Server B (${proxyUrl}) returned ${res.status}: ${await readErrorBody(res)}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
proxyInfo = await res.json();
|
|
||||||
console.log(` B: ${proxyInfo.url}`);
|
|
||||||
console.log(` signing: ${fingerprintKey(proxyInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(proxyInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` peers: ${proxyInfo.peers.length}`);
|
|
||||||
} catch (err) {
|
|
||||||
console.error(`Cannot reach Server B at ${proxyUrl}/discover: ${err instanceof Error ? err.message : err}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
const isFallbackMode = process.argv.includes("--test-fallback");
|
|
||||||
|
|
||||||
if (isFallbackMode) {
|
|
||||||
// C is blocked from A — load C's info from A's local registry instead
|
|
||||||
const [cRecord] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, targetUrl)).limit(1);
|
|
||||||
if (!cRecord) {
|
|
||||||
console.error(` Server C (${targetUrl}) not found in local registry. Run mutual discovery before blocking.`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
targetInfo = {
|
|
||||||
url: cRecord.url,
|
|
||||||
publicKey: cRecord.publicKey,
|
|
||||||
encryptionPublicKey: cRecord.encryptionPublicKey,
|
|
||||||
peers: [],
|
|
||||||
};
|
|
||||||
console.log(` C: ${targetInfo.url} (from local registry — blocked)`);
|
|
||||||
console.log(` signing: ${fingerprintKey(targetInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(targetInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
} else {
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${targetUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
if (!res.ok) {
|
|
||||||
console.error(`Server C (${targetUrl}) returned ${res.status}: ${await readErrorBody(res)}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
targetInfo = await res.json();
|
|
||||||
console.log(` C: ${targetInfo.url}`);
|
|
||||||
console.log(` signing: ${fingerprintKey(targetInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(targetInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` peers: ${targetInfo.peers.length}`);
|
|
||||||
} catch (err) {
|
|
||||||
console.error(`Cannot reach Server C at ${targetUrl}/discover: ${err instanceof Error ? err.message : err}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const aOnB = proxyInfo.peers.some((p) => p.url === ORIGIN);
|
|
||||||
console.log(` A registered on B: ${aOnB}`);
|
|
||||||
|
|
||||||
if (!aOnB) {
|
|
||||||
console.error("\n A is not registered on B. Run mutual discovery first.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isFallbackMode) {
|
|
||||||
const aOnC = targetInfo.peers.some((p) => p.url === ORIGIN);
|
|
||||||
console.log(` A registered on C: ${aOnC}`);
|
|
||||||
if (!aOnC) {
|
|
||||||
console.error("\n A is not registered on C. Run mutual discovery first.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 2–5: Direct tests (skipped in --test-fallback mode since C is blocked)
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
if (isFallbackMode) {
|
|
||||||
console.log("\n Skipping direct tests (2–5) — C is blocked in fallback mode.");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isFallbackMode) {
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 2. Full proxy relay: A → B → C → B → A
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
console.log("\n── Test: Full proxy relay (A → B → C → B → A) ─────────");
|
|
||||||
|
|
||||||
{
|
|
||||||
const testName = "full proxy relay";
|
|
||||||
try {
|
|
||||||
const nonce = crypto.randomUUID();
|
|
||||||
const innerPayload = JSON.stringify({
|
|
||||||
action: "proxy-test",
|
|
||||||
nonce,
|
|
||||||
timestamp: Date.now(),
|
|
||||||
sender: ORIGIN,
|
|
||||||
});
|
|
||||||
|
|
||||||
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
|
||||||
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
|
||||||
const signature = signMessage(innerPayload, new Uint8Array(Buffer.from(process.env.FEDERATION_PRIVATE_KEY!, "base64")));
|
|
||||||
|
|
||||||
const proxyBody = {
|
|
||||||
method: "PROXY",
|
|
||||||
targetUrl: targetUrl + "/proxy",
|
|
||||||
publicSigningKey: OWN_SIGNING_PUB,
|
|
||||||
publicEncryptionKey: OWN_ENCRYPTION_PUB,
|
|
||||||
payload: encrypted,
|
|
||||||
signature,
|
|
||||||
};
|
|
||||||
|
|
||||||
const res = await fetch(`${proxyUrl}/proxy`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Federation-Origin": ORIGIN,
|
|
||||||
"Origin": ORIGIN,
|
|
||||||
},
|
|
||||||
body: JSON.stringify(proxyBody),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const body = await res.json();
|
|
||||||
|
|
||||||
if (res.status !== 200) {
|
|
||||||
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
|
||||||
} else if (body.method !== "PROXY_RESPONSE") {
|
|
||||||
fail(testName, `expected method=PROXY_RESPONSE, got ${body.method}`);
|
|
||||||
} else if (!body.payload) {
|
|
||||||
fail(testName, "response missing payload (B did not relay C's response)");
|
|
||||||
} else if (body.payload.method !== "PROXY_RESPONSE") {
|
|
||||||
fail(testName, `inner payload method=${body.payload.method}, expected PROXY_RESPONSE`);
|
|
||||||
} else {
|
|
||||||
pass(testName, `nonce=${nonce}, C responded: "${body.payload.message ?? JSON.stringify(body.payload)}"`);
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 3. Direct TARGETED: A → C
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
console.log("\n── Test: Direct TARGETED (A → C) ────────────────────────");
|
|
||||||
|
|
||||||
{
|
|
||||||
const testName = "direct TARGETED to C";
|
|
||||||
try {
|
|
||||||
const innerPayload = JSON.stringify({
|
|
||||||
action: "targeted-test",
|
|
||||||
nonce: crypto.randomUUID(),
|
|
||||||
sender: ORIGIN,
|
|
||||||
});
|
|
||||||
|
|
||||||
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
|
||||||
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
|
||||||
|
|
||||||
const res = await fetch(`${targetUrl}/proxy`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Federation-Origin": ORIGIN,
|
|
||||||
"Origin": ORIGIN,
|
|
||||||
},
|
|
||||||
body: JSON.stringify({
|
|
||||||
method: "TARGETED",
|
|
||||||
payload: encrypted,
|
|
||||||
}),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const body = await res.json();
|
|
||||||
|
|
||||||
if (res.status !== 200) {
|
|
||||||
fail(testName, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
|
|
||||||
} else if (body.method !== "PROXY_RESPONSE") {
|
|
||||||
fail(testName, `expected method=PROXY_RESPONSE, got ${body.method}`);
|
|
||||||
} else {
|
|
||||||
pass(testName, `C says: "${body.message}"`);
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 4. Sender validation — bad signing key
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
console.log("\n── Test: Sender validation (bad keys → B) ──────────────");
|
|
||||||
|
|
||||||
{
|
|
||||||
const testName = "reject mismatched signing key";
|
|
||||||
try {
|
|
||||||
const fakeKeys = generateEnvKeyPair();
|
|
||||||
|
|
||||||
const innerPayload = JSON.stringify({ action: "bad-key-test" });
|
|
||||||
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
|
||||||
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
|
||||||
|
|
||||||
const proxyBody = {
|
|
||||||
method: "PROXY",
|
|
||||||
targetUrl: targetUrl + "/proxy",
|
|
||||||
publicSigningKey: fakeKeys.signingPublicKey,
|
|
||||||
publicEncryptionKey: OWN_ENCRYPTION_PUB,
|
|
||||||
payload: encrypted,
|
|
||||||
};
|
|
||||||
|
|
||||||
const res = await fetch(`${proxyUrl}/proxy`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Federation-Origin": ORIGIN,
|
|
||||||
"Origin": ORIGIN,
|
|
||||||
},
|
|
||||||
body: JSON.stringify(proxyBody),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const body = await res.json();
|
|
||||||
|
|
||||||
if (res.status === 403 && body.code === "INCORRECT_KEYS") {
|
|
||||||
pass(testName, `B correctly rejected: "${body.error}"`);
|
|
||||||
} else {
|
|
||||||
fail(testName, `expected 403/INCORRECT_KEYS, got ${res.status}/${body.code}: ${JSON.stringify(body)}`);
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 5. Unknown sender
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
console.log("\n── Test: Unknown sender (→ B) ────────────────────────────");
|
|
||||||
|
|
||||||
{
|
|
||||||
const testName = "reject unknown sender";
|
|
||||||
try {
|
|
||||||
const unknownKeys = generateEnvKeyPair();
|
|
||||||
const unknownOrigin = "https://totally-unknown-federation-" + crypto.randomUUID().slice(0, 8) + ".test";
|
|
||||||
|
|
||||||
const innerPayload = JSON.stringify({ action: "unknown-sender-test" });
|
|
||||||
const targetEncKey = new Uint8Array(Buffer.from(targetInfo.encryptionPublicKey, "base64"));
|
|
||||||
const encrypted = encryptPayload(innerPayload, targetEncKey);
|
|
||||||
|
|
||||||
const proxyBody = {
|
|
||||||
method: "PROXY",
|
|
||||||
targetUrl: targetUrl + "/proxy",
|
|
||||||
publicSigningKey: unknownKeys.signingPublicKey,
|
|
||||||
publicEncryptionKey: unknownKeys.encryptionPublicKey,
|
|
||||||
payload: encrypted,
|
|
||||||
};
|
|
||||||
|
|
||||||
const res = await fetch(`${proxyUrl}/proxy`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Federation-Origin": unknownOrigin,
|
|
||||||
"Origin": unknownOrigin,
|
|
||||||
},
|
|
||||||
body: JSON.stringify(proxyBody),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const body = await res.json();
|
|
||||||
|
|
||||||
if (res.status === 403 && body.code === "UNKNOWN_FEDERATION_SERVER_INTERACTION") {
|
|
||||||
pass(testName, `B correctly rejected: "${body.error}"`);
|
|
||||||
} else {
|
|
||||||
fail(testName, `expected 403/UNKNOWN_FEDERATION_SERVER_INTERACTION, got ${res.status}/${body.code}: ${JSON.stringify(body)}`);
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
} // end if (!isFallbackMode)
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 6. Auto proxy fallback via real follow delivery pipeline
|
|
||||||
// Sends a follow request through A's API → BullMQ worker picks it up →
|
|
||||||
// federationFetch with proxyFallback:true → direct to C fails → proxied
|
|
||||||
// through B → C processes → worker updates follow.accepted
|
|
||||||
//
|
|
||||||
// Requires:
|
|
||||||
// - Server C blocked from A (firewall)
|
|
||||||
// - --bearer <token> and --user <userId> flags
|
|
||||||
//
|
|
||||||
// Block C: netsh advfirewall firewall add rule name="Block Federation C" dir=out action=block remoteip=<C_IP> remoteport=<C_PORT> protocol=tcp
|
|
||||||
// Unblock: netsh advfirewall firewall delete rule name="Block Federation C"
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
if (isFallbackMode) {
|
|
||||||
console.log("\n── Test: Auto proxy fallback (follow delivery pipeline) ─");
|
|
||||||
|
|
||||||
if (!bearerToken || !targetUserId) {
|
|
||||||
console.error(" --test-fallback requires --bearer <token> and --user <userId>");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Step 1: verify C is unreachable directly
|
|
||||||
{
|
|
||||||
const testName = "direct fetch to C fails";
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${targetUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(5_000),
|
|
||||||
});
|
|
||||||
fail(testName, `direct fetch succeeded (${res.status}) — C is not blocked from A. Block it first.`);
|
|
||||||
} catch {
|
|
||||||
pass(testName, "C is unreachable from A (blocked)");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Step 2: send follow request through A's API
|
|
||||||
{
|
|
||||||
const testName = "follow delivery via proxy fallback";
|
|
||||||
try {
|
|
||||||
console.log(` Sending follow request for user ${targetUserId} on ${targetUrl}...`);
|
|
||||||
|
|
||||||
const followRes = await fetch(`${ORIGIN}/api/auth/social/follows`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
"Authorization": `Bearer ${bearerToken}`,
|
|
||||||
},
|
|
||||||
body: JSON.stringify({
|
|
||||||
method: "INSERT",
|
|
||||||
userId: targetUserId,
|
|
||||||
federationUrl: targetUrl,
|
|
||||||
}),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const followBody = await followRes.json();
|
|
||||||
|
|
||||||
if (!followRes.ok) {
|
|
||||||
fail(testName, `follow request failed (${followRes.status}): ${JSON.stringify(followBody)}`);
|
|
||||||
} else {
|
|
||||||
const followId = followBody.following?.[0]?.id;
|
|
||||||
if (!followId) {
|
|
||||||
fail(testName, `follow created but no ID returned: ${JSON.stringify(followBody)}`);
|
|
||||||
} else {
|
|
||||||
console.log(` Follow record created: ${followId}`);
|
|
||||||
console.log(" Waiting for BullMQ worker to process delivery job...");
|
|
||||||
|
|
||||||
// Step 3: poll until the delivery job completes (worker processes it)
|
|
||||||
const maxWait = 60_000;
|
|
||||||
const pollInterval = 2_000;
|
|
||||||
let elapsed = 0;
|
|
||||||
let delivered = false;
|
|
||||||
|
|
||||||
while (elapsed < maxWait) {
|
|
||||||
await new Promise((r) => setTimeout(r, pollInterval));
|
|
||||||
elapsed += pollInterval;
|
|
||||||
|
|
||||||
// Check if delivery job for this target still exists (removed on success)
|
|
||||||
const pendingJobs = await db.select()
|
|
||||||
.from(deliveryJobs)
|
|
||||||
.where(eq(deliveryJobs.targetUrl, targetUrl + "/api/auth/social/follows"))
|
|
||||||
.orderBy(desc(deliveryJobs.createdAt))
|
|
||||||
.limit(5);
|
|
||||||
|
|
||||||
// Check if follow.accepted was updated (worker sets this on success)
|
|
||||||
const [followRecord] = await db.select()
|
|
||||||
.from(follows)
|
|
||||||
.where(eq(follows.id, followId))
|
|
||||||
.limit(1);
|
|
||||||
|
|
||||||
const jobCount = pendingJobs.length;
|
|
||||||
const accepted = followRecord?.accepted;
|
|
||||||
|
|
||||||
process.stdout.write(`\r Polling... ${Math.round(elapsed / 1000)}s — jobs pending: ${jobCount}, accepted: ${accepted} `);
|
|
||||||
|
|
||||||
if (accepted === true) {
|
|
||||||
delivered = true;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("");
|
|
||||||
|
|
||||||
if (delivered) {
|
|
||||||
pass(testName, "follow delivered through proxy and accepted by C");
|
|
||||||
} else {
|
|
||||||
// Check final state for diagnostics
|
|
||||||
const [finalFollow] = await db.select()
|
|
||||||
.from(follows)
|
|
||||||
.where(eq(follows.id, followId))
|
|
||||||
.limit(1);
|
|
||||||
|
|
||||||
const remainingJobs = await db.select()
|
|
||||||
.from(deliveryJobs)
|
|
||||||
.where(eq(deliveryJobs.targetUrl, targetUrl + "/api/auth/social/follows"))
|
|
||||||
.limit(5);
|
|
||||||
|
|
||||||
fail(testName,
|
|
||||||
`timed out after ${maxWait / 1000}s. ` +
|
|
||||||
`follow.accepted=${finalFollow?.accepted}, ` +
|
|
||||||
`pending delivery jobs=${remainingJobs.length}. ` +
|
|
||||||
`Check worker logs (DEBUG=app:federation:*) for details.`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Cleanup: remove the test follow record
|
|
||||||
console.log(" Cleaning up test follow record...");
|
|
||||||
// await db.delete(follows).where(eq(follows.id, followId));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
console.log("\n Skipping auto-fallback test (pass --test-fallback to enable).");
|
|
||||||
console.log(" Requires: --test-fallback --bearer <token> --user <userId>");
|
|
||||||
console.log(" And C must be blocked from A's machine (firewall rule).");
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Summary
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
const passed = results.filter((r) => r.passed);
|
|
||||||
const failed = results.filter((r) => !r.passed);
|
|
||||||
|
|
||||||
console.log("\n════════════════════════════════════════════════════════");
|
|
||||||
console.log(`Results: ${passed.length} passed, ${failed.length} failed out of ${results.length}`);
|
|
||||||
|
|
||||||
if (failed.length > 0) {
|
|
||||||
console.error("\nFailed tests:");
|
|
||||||
failed.forEach((f) => console.error(` ✘ ${f.name}: ${f.message}`));
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("\nAll tests passed.");
|
|
||||||
process.exit(0);
|
|
||||||
|
|
@ -1,409 +0,0 @@
|
||||||
/**
|
|
||||||
* Manual post proxy / federation test (Server A).
|
|
||||||
*
|
|
||||||
* Exercises the real path only — same as production:
|
|
||||||
* POST ${A}/api/auth/social/posts → BullMQ worker → federationFetch (direct or via proxy B) → C.
|
|
||||||
*
|
|
||||||
* Does not POST ciphertext to B’s `/proxy` by hand; the worker does that after your createPost.
|
|
||||||
*
|
|
||||||
* Usage:
|
|
||||||
* bun run tests/proxies/post.ts --proxy <B_URL> --target <C_URL> --bearer <session_on_A>
|
|
||||||
*
|
|
||||||
* Prerequisites on A:
|
|
||||||
* - Bearer user must have at least one accepted follower whose `followerServerUrl` points at C
|
|
||||||
* (same base URL as `--target` / registry).
|
|
||||||
* - Propagation must enqueue jobs (e.g. policy `all`, or private + `followers`).
|
|
||||||
*
|
|
||||||
* Optional:
|
|
||||||
* --test-fallback C blocked from A: load C from A’s server_registry only; verify direct C fetch fails first
|
|
||||||
* --test-no-remote-followers Expect 200 with federationDeliveriesQueued === 0 (propagation on, no remote follower URLs)
|
|
||||||
*
|
|
||||||
* Examples:
|
|
||||||
* bun run tests/proxies/post.ts --proxy http://localhost:3001 --target http://host.docker.internal:3002 --bearer <tok> --test-fallback
|
|
||||||
*/
|
|
||||||
|
|
||||||
import db from "@/lib/db";
|
|
||||||
import { deliveryJobs, serverRegistry } from "@/lib/db/schema";
|
|
||||||
import { fingerprintKey } from "@/lib/federation/keytools";
|
|
||||||
import { config } from "dotenv";
|
|
||||||
import { and, desc, eq, like } from "drizzle-orm";
|
|
||||||
|
|
||||||
config({ path: ".env.local" });
|
|
||||||
|
|
||||||
const FETCH_TIMEOUT_MS = 15_000;
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Helpers
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
async function readErrorBody(response: Response): Promise<string> {
|
|
||||||
try {
|
|
||||||
const body = await response.json();
|
|
||||||
return body?.error ?? body?.message ?? JSON.stringify(body);
|
|
||||||
} catch {
|
|
||||||
try {
|
|
||||||
return await response.text();
|
|
||||||
} catch {
|
|
||||||
return response.statusText;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
interface TestResult {
|
|
||||||
name: string;
|
|
||||||
passed: boolean;
|
|
||||||
message: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
const results: TestResult[] = [];
|
|
||||||
|
|
||||||
function pass(name: string, message = "OK") {
|
|
||||||
console.log(` ✔ ${name}`);
|
|
||||||
if (message !== "OK") console.log(` ${message}`);
|
|
||||||
results.push({ name, passed: true, message });
|
|
||||||
}
|
|
||||||
|
|
||||||
function fail(name: string, message: string) {
|
|
||||||
console.error(` ✘ ${name}`);
|
|
||||||
console.error(` ${message}`);
|
|
||||||
results.push({ name, passed: false, message });
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Validate environment
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
const REQUIRED_ENV = [
|
|
||||||
"FEDERATION_PUBLIC_KEY",
|
|
||||||
"FEDERATION_PRIVATE_KEY",
|
|
||||||
"FEDERATION_ENCRYPTION_PUBLIC_KEY",
|
|
||||||
"FEDERATION_ENCRYPTION_PRIVATE_KEY",
|
|
||||||
"BETTER_AUTH_URL",
|
|
||||||
] as const;
|
|
||||||
|
|
||||||
const missing = REQUIRED_ENV.filter((k) => !process.env[k]);
|
|
||||||
if (missing.length > 0) {
|
|
||||||
console.error("Missing required environment variables:");
|
|
||||||
missing.forEach((k) => console.error(` - ${k}`));
|
|
||||||
console.error("Ensure .env.local is present and populated.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
const ORIGIN = process.env.BETTER_AUTH_URL!;
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Parse arguments
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
function argAfter(flag: string): string | undefined {
|
|
||||||
const idx = process.argv.indexOf(flag);
|
|
||||||
return idx !== -1 ? process.argv[idx + 1] : undefined;
|
|
||||||
}
|
|
||||||
|
|
||||||
const proxyUrl = argAfter("--proxy");
|
|
||||||
const targetUrl = argAfter("--target");
|
|
||||||
const bearerToken = argAfter("--bearer");
|
|
||||||
const testNoRemoteFollowers = process.argv.includes("--test-no-remote-followers");
|
|
||||||
const isFallbackMode = process.argv.includes("--test-fallback");
|
|
||||||
|
|
||||||
if (!proxyUrl || !targetUrl || !bearerToken) {
|
|
||||||
console.error(
|
|
||||||
"Usage: bun run tests/proxies/post.ts --proxy <B_URL> --target <C_URL> --bearer <session_on_A> [options]",
|
|
||||||
);
|
|
||||||
console.error("");
|
|
||||||
console.error(" --proxy Server B (proxy); used for /discover sanity check");
|
|
||||||
console.error(" --target Server C base URL (must match server_registry.url on A for --test-fallback)");
|
|
||||||
console.error(" --bearer Session token on A (required — test hits POST /api/auth/social/posts)");
|
|
||||||
console.error(" --test-fallback C unreachable from A; load C from registry; verify block then deliver via API");
|
|
||||||
console.error(" --test-no-remote-followers Expect createPost 400 NO_REMOTE_FOLLOWERS (runs after main test if set)");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (testNoRemoteFollowers && !bearerToken) {
|
|
||||||
console.error("--test-no-remote-followers requires --bearer <tok>");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("Post delivery test (A API → worker → federation/proxy)");
|
|
||||||
console.log(` Server A (us): ${ORIGIN}`);
|
|
||||||
console.log(` Server B (proxy): ${proxyUrl}`);
|
|
||||||
console.log(` Server C (target): ${targetUrl}`);
|
|
||||||
|
|
||||||
const DEFAULT_POST_CONTENT = [{ type: "text" as const, value: "proxy post test" }];
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 1. Discovery (B reachable from A; C from registry or live)
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
interface DiscoverResponse {
|
|
||||||
url: string;
|
|
||||||
publicKey: string;
|
|
||||||
encryptionPublicKey: string;
|
|
||||||
peers: { url: string; isHealthy: boolean }[];
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("\n── Discovery ────────────────────────────────────────────");
|
|
||||||
|
|
||||||
let proxyInfo: DiscoverResponse;
|
|
||||||
let targetInfo: DiscoverResponse;
|
|
||||||
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${proxyUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
if (!res.ok) {
|
|
||||||
console.error(`Server B (${proxyUrl}) returned ${res.status}: ${await readErrorBody(res)}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
proxyInfo = await res.json();
|
|
||||||
console.log(` B: ${proxyInfo.url}`);
|
|
||||||
console.log(` signing: ${fingerprintKey(proxyInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(proxyInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` peers: ${proxyInfo.peers.length}`);
|
|
||||||
} catch (err) {
|
|
||||||
console.error(`Cannot reach Server B at ${proxyUrl}/discover: ${err instanceof Error ? err.message : err}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (isFallbackMode) {
|
|
||||||
const [cRecord] = await db.select().from(serverRegistry).where(eq(serverRegistry.url, targetUrl)).limit(1);
|
|
||||||
if (!cRecord) {
|
|
||||||
console.error(` Server C (${targetUrl}) not found in local registry. Run mutual discovery before blocking.`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
targetInfo = {
|
|
||||||
url: cRecord.url,
|
|
||||||
publicKey: cRecord.publicKey,
|
|
||||||
encryptionPublicKey: cRecord.encryptionPublicKey,
|
|
||||||
peers: [],
|
|
||||||
};
|
|
||||||
console.log(` C: ${targetInfo.url} (from local registry — blocked from A)`);
|
|
||||||
console.log(` signing: ${fingerprintKey(targetInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(targetInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
} else {
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${targetUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
if (!res.ok) {
|
|
||||||
console.error(`Server C (${targetUrl}) returned ${res.status}: ${await readErrorBody(res)}`);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
targetInfo = await res.json();
|
|
||||||
console.log(` C: ${targetInfo.url}`);
|
|
||||||
console.log(` signing: ${fingerprintKey(targetInfo.publicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` encryption: ${fingerprintKey(targetInfo.encryptionPublicKey).slice(0, 16)}…`);
|
|
||||||
console.log(` peers: ${targetInfo.peers.length}`);
|
|
||||||
} catch (err) {
|
|
||||||
console.error(`Cannot reach Server C at ${targetUrl}/discover: ${err instanceof Error ? err.message : err}`);
|
|
||||||
console.error("\n If C is firewalled from A, pass --test-fallback (load C from A’s registry).");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const aOnB = proxyInfo.peers.some((p) => p.url === ORIGIN);
|
|
||||||
console.log(` A registered on B: ${aOnB}`);
|
|
||||||
|
|
||||||
if (!aOnB) {
|
|
||||||
console.error("\n A is not registered on B. Run mutual discovery first.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!isFallbackMode) {
|
|
||||||
const aOnC = targetInfo.peers.some((p) => p.url === ORIGIN);
|
|
||||||
console.log(` A registered on C: ${aOnC}`);
|
|
||||||
if (!aOnC) {
|
|
||||||
console.error("\n A is not registered on C. Run mutual discovery first.");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const targetPostsUrl = `${targetInfo.url.replace(/\/$/, "")}/api/auth/social/posts`;
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 2. Optional: confirm C is unreachable when --test-fallback
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
if (isFallbackMode) {
|
|
||||||
console.log("\n── Test: direct fetch to C fails (blocked) ─────────────");
|
|
||||||
|
|
||||||
const testName = "direct fetch to C fails";
|
|
||||||
try {
|
|
||||||
const res = await fetch(`${targetUrl}/discover`, {
|
|
||||||
signal: AbortSignal.timeout(5_000),
|
|
||||||
});
|
|
||||||
fail(testName, `direct fetch succeeded (${res.status}) — C is not blocked from A. Block it first.`);
|
|
||||||
} catch {
|
|
||||||
pass(testName, "C is unreachable from A (blocked)");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 3. Real createPost on A → worker → C (via proxy when needed)
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
console.log("\n── Test: post delivery via A API + worker ──────────────");
|
|
||||||
|
|
||||||
{
|
|
||||||
const testName = "POST /api/auth/social/posts → deliver-post job completes";
|
|
||||||
try {
|
|
||||||
console.log(` Creating post on A; expecting delivery to ${targetPostsUrl}…`);
|
|
||||||
|
|
||||||
const postRes = await fetch(`${ORIGIN}/api/auth/social/posts`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
Authorization: `Bearer ${bearerToken}`,
|
|
||||||
},
|
|
||||||
body: JSON.stringify(DEFAULT_POST_CONTENT),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const postBody = await postRes.json();
|
|
||||||
|
|
||||||
if (!postRes.ok) {
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
`createPost failed (${postRes.status}): ${JSON.stringify(postBody)} — need accepted remote followers on C and propagating policy`,
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
const postId = postBody.id as string | undefined;
|
|
||||||
if (!postId) {
|
|
||||||
fail(testName, `no post id in response: ${JSON.stringify(postBody)}`);
|
|
||||||
} else {
|
|
||||||
console.log(` Post created: ${postId}`);
|
|
||||||
console.log(" Waiting for BullMQ worker to deliver FEDERATE_POST…");
|
|
||||||
|
|
||||||
await new Promise((r) => setTimeout(r, 300));
|
|
||||||
|
|
||||||
const jobsForPost = await db
|
|
||||||
.select()
|
|
||||||
.from(deliveryJobs)
|
|
||||||
.where(like(deliveryJobs.payload, `%${postId}%`));
|
|
||||||
|
|
||||||
if (jobsForPost.length === 0) {
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
"No delivery_jobs row for this post after createPost — propagation off, federationDeliveriesQueued was 0, or bug.",
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
const forTarget = jobsForPost.filter((j) => j.targetUrl === targetPostsUrl);
|
|
||||||
if (forTarget.length === 0) {
|
|
||||||
const urls = [...new Set(jobsForPost.map((j) => j.targetUrl))].join(", ");
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
`Delivery job(s) target other URL(s): ${urls} — expected ${targetPostsUrl} (followerServerUrl must match C).`,
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
const maxWait = 60_000;
|
|
||||||
const pollInterval = 2_000;
|
|
||||||
let elapsed = 300;
|
|
||||||
let delivered = false;
|
|
||||||
|
|
||||||
while (elapsed < maxWait) {
|
|
||||||
await new Promise((r) => setTimeout(r, pollInterval));
|
|
||||||
elapsed += pollInterval;
|
|
||||||
|
|
||||||
const pendingJobs = await db
|
|
||||||
.select()
|
|
||||||
.from(deliveryJobs)
|
|
||||||
.where(
|
|
||||||
and(
|
|
||||||
eq(deliveryJobs.targetUrl, targetPostsUrl),
|
|
||||||
like(deliveryJobs.payload, `%${postId}%`),
|
|
||||||
),
|
|
||||||
)
|
|
||||||
.orderBy(desc(deliveryJobs.createdAt))
|
|
||||||
.limit(5);
|
|
||||||
|
|
||||||
process.stdout.write(
|
|
||||||
`\r Polling… ${Math.round(elapsed / 1000)}s — pending jobs for this post: ${pendingJobs.length} `,
|
|
||||||
);
|
|
||||||
|
|
||||||
if (pendingJobs.length === 0) {
|
|
||||||
delivered = true;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("");
|
|
||||||
|
|
||||||
if (delivered) {
|
|
||||||
pass(testName, "delivery job finished (worker reached C, direct or via proxy)");
|
|
||||||
} else {
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
`timed out after ${maxWait / 1000}s with jobs still pending. ` +
|
|
||||||
`Check worker (DEBUG=app:federation:*), Redis, proxy, and firewall.`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// 4. Optional: propagation on but no remote URLs (200, zero deliveries)
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
if (testNoRemoteFollowers) {
|
|
||||||
console.log("\n── Test: createPost 200 + federationDeliveriesQueued === 0 ─");
|
|
||||||
|
|
||||||
const testName = "createPost saves post but queues no federation deliveries";
|
|
||||||
try {
|
|
||||||
const postRes = await fetch(`${ORIGIN}/api/auth/social/posts`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: {
|
|
||||||
"Content-Type": "application/json",
|
|
||||||
Authorization: `Bearer ${bearerToken}`,
|
|
||||||
},
|
|
||||||
body: JSON.stringify(DEFAULT_POST_CONTENT),
|
|
||||||
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
|
|
||||||
});
|
|
||||||
|
|
||||||
const postBody = await postRes.json();
|
|
||||||
|
|
||||||
if (
|
|
||||||
postRes.status === 200 &&
|
|
||||||
postBody.id &&
|
|
||||||
postBody.federationDeliveriesQueued === 0
|
|
||||||
) {
|
|
||||||
pass(testName, `post ${postBody.id} — no remote follower server URLs under propagation`);
|
|
||||||
} else if (postRes.ok && postBody.federationDeliveriesQueued > 0) {
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
`expected federationDeliveriesQueued === 0, got ${postBody.federationDeliveriesQueued} (user has remote followers or wrong test account).`,
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
fail(
|
|
||||||
testName,
|
|
||||||
`expected 200 with id and federationDeliveriesQueued 0, got ${postRes.status}: ${JSON.stringify(postBody)}`,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
fail(testName, `${err instanceof Error ? err.message : err}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
// Summary
|
|
||||||
// ---------------------------------------------------------------------------
|
|
||||||
|
|
||||||
const passed = results.filter((r) => r.passed);
|
|
||||||
const failed = results.filter((r) => !r.passed);
|
|
||||||
|
|
||||||
console.log("\n════════════════════════════════════════════════════════");
|
|
||||||
console.log(`Results: ${passed.length} passed, ${failed.length} failed out of ${results.length}`);
|
|
||||||
|
|
||||||
if (failed.length > 0) {
|
|
||||||
console.error("\nFailed tests:");
|
|
||||||
failed.forEach((f) => console.error(` ✘ ${f.name}: ${f.message}`));
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log("\nAll tests passed.");
|
|
||||||
process.exit(0);
|
|
||||||
28
tests/proxy/README.md
Normal file
28
tests/proxy/README.md
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
# `/proxy` automated tests
|
||||||
|
|
||||||
|
Suite files use **`*.e2e.ts`** (Playwright); run with `npm run test:proxy` or `npm test`, not `bun test`.
|
||||||
|
|
||||||
|
## Coverage
|
||||||
|
|
||||||
|
- **Transport hygiene**: missing `X-Federation-Origin`, oversized bodies (`413`), invalid JSON (`INVALID_PROXY_DATA`), schema mismatches on PROXY (`INVALID_PROXY_DATA`).
|
||||||
|
- **PROXY sender bookkeeping**: unknown federation origins (`UNKNOWN_FEDERATION_SERVER_INTERACTION`), signing vs encryption key mismatches vs registry (`INCORRECT_KEYS`).
|
||||||
|
- **TARGETED decryption**: wrong-recipient ciphertext (`DECRYPT_FAILED` explicit code separate from generic failures removed during audit).
|
||||||
|
- **Header binding**: decrypted payloads whose `X-Federation-Target` origin disagrees with `targetUrl` are rejected (`INVALID_TARGETED_DATA`).
|
||||||
|
- **Trust layering**: unknown decrypted sender URLs, blacklisted senders (`BLACKLISTED_FEDERATION_SERVER`), invalid Ed25519 follow signatures (`INVALID_SIGNATURE`).
|
||||||
|
- **Happy path**: `FEDERATE_FOLLOW` via TARGETED creates a local follow row and returns `PROXY_RESPONSE` encrypted ACK bytes verifiable with the hub federation signing key.
|
||||||
|
- **Dedup**: repeating identical follower/target identities yields `409 FOLLOW_ALREADY_EXISTS` thanks to DB uniqueness (`follows_follower_following_uidx`).
|
||||||
|
- **Rate limiting**: per-origin Redis sliding window (`429 RATE_LIMITED`) enforced **before** expensive decryption paths.
|
||||||
|
|
||||||
|
## Primary source files
|
||||||
|
|
||||||
|
- [`src/app/proxy/route.ts`](../../src/app/proxy/route.ts)
|
||||||
|
- [`src/lib/zod/methods/FollowSchema.ts`](../../src/lib/zod/methods/FollowSchema.ts)
|
||||||
|
- [`src/lib/db/schema/index.ts`](../../src/lib/db/schema/index.ts) (`follows`, `server_registry`, `blacklisted_servers`, `user`)
|
||||||
|
- [`src/lib/federation/keytools.ts`](../../src/lib/federation/keytools.ts)
|
||||||
|
- [`src/lib/rate-limit/rate-limit.ts`](../../src/lib/rate-limit/rate-limit.ts) (nested `/proxy` limiter keyed per federation URL header)
|
||||||
|
|
||||||
|
## Edge cases & limitations
|
||||||
|
|
||||||
|
- `/proxy` no longer wraps unexpected failures behind `"Invalid proxied data"` — decrypt failures expose **`DECRYPT_FAILED`**. Unexpected handler/database faults propagate as generic HTTP 500s (surfacing regressions loudly).
|
||||||
|
- **GLOBAL purge caveat**: `beforeEach` truncates **all** `follows` rows to keep isolation cheap — acceptable only against disposable QA databases.
|
||||||
|
- Full **`PROXY` relay round-trip** to another live Node still belongs to [`tests/integration/proxy-chain.ts`](../integration/proxy-chain.ts).
|
||||||
470
tests/proxy/proxy.e2e.ts
Normal file
470
tests/proxy/proxy.e2e.ts
Normal file
|
|
@ -0,0 +1,470 @@
|
||||||
|
/**
|
||||||
|
* /proxy — PROXY relay bookkeeping + TARGETED decryption / validation / FEDERATE_FOLLOW handling.
|
||||||
|
*/
|
||||||
|
import db from "@/lib/db";
|
||||||
|
import { follows, serverRegistry, user } from "@/lib/db/schema";
|
||||||
|
import {
|
||||||
|
decryptPayload,
|
||||||
|
encryptPayload,
|
||||||
|
signMessage,
|
||||||
|
verifySignature,
|
||||||
|
} from "@/lib/federation/keytools";
|
||||||
|
import { expect, test } from "@playwright/test";
|
||||||
|
import { eq } from "drizzle-orm";
|
||||||
|
import {
|
||||||
|
clearTables,
|
||||||
|
generateEnvKeyPair,
|
||||||
|
seedBlacklist,
|
||||||
|
seedServer,
|
||||||
|
} from "../helpers/db";
|
||||||
|
import { seedMinimalUser } from "../helpers/identity";
|
||||||
|
|
||||||
|
test.describe.configure({ mode: "serial" });
|
||||||
|
|
||||||
|
const SENDER_URL = "https://proxy-remote-peer.test";
|
||||||
|
const senderKeys = generateEnvKeyPair();
|
||||||
|
|
||||||
|
function origin(): string {
|
||||||
|
return process.env.BETTER_AUTH_URL!.replace(/\/$/, "");
|
||||||
|
}
|
||||||
|
|
||||||
|
function recipientEncryptionPublicKey(): Uint8Array {
|
||||||
|
return new Uint8Array(Buffer.from(process.env.FEDERATION_ENCRYPTION_PUBLIC_KEY!, "base64"));
|
||||||
|
}
|
||||||
|
|
||||||
|
async function resetRegistryAndSender() {
|
||||||
|
await db.delete(follows);
|
||||||
|
await clearTables();
|
||||||
|
await seedServer(SENDER_URL, senderKeys.signingPublicKey, senderKeys.encryptionPublicKey);
|
||||||
|
}
|
||||||
|
|
||||||
|
test.beforeEach(async () => {
|
||||||
|
await resetRegistryAndSender();
|
||||||
|
});
|
||||||
|
|
||||||
|
/** Builds TARGETED outer envelope + JSON POST body for /proxy. */
|
||||||
|
function buildFollowTargetedEnvelope(followerId: string, followingId: string, sigTamper?: string) {
|
||||||
|
const innerFollow = {
|
||||||
|
federationUrl: SENDER_URL,
|
||||||
|
method: "FEDERATE" as const,
|
||||||
|
following: {
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
createdAt: new Date().toISOString(),
|
||||||
|
followerId,
|
||||||
|
followingId,
|
||||||
|
accepted: false,
|
||||||
|
followerServerUrl: SENDER_URL as string | null,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
const innerRaw = JSON.stringify(innerFollow);
|
||||||
|
const senderSigningSecret = new Uint8Array(Buffer.from(senderKeys.signingSecretKey, "base64"));
|
||||||
|
const followSig = sigTamper ?? signMessage(innerRaw, senderSigningSecret);
|
||||||
|
const followEnv = encryptPayload(innerRaw, recipientEncryptionPublicKey());
|
||||||
|
const fedOuterStr = JSON.stringify({
|
||||||
|
method: "FEDERATE",
|
||||||
|
payload: followEnv,
|
||||||
|
signature: followSig,
|
||||||
|
});
|
||||||
|
const targetApi = `${origin()}/api/auth/social/follows`;
|
||||||
|
const wire = JSON.stringify({
|
||||||
|
targetUrl: targetApi,
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": SENDER_URL,
|
||||||
|
"X-Federation-Target": targetApi,
|
||||||
|
"Origin": SENDER_URL,
|
||||||
|
},
|
||||||
|
body: fedOuterStr,
|
||||||
|
});
|
||||||
|
const outerEnv = encryptPayload(wire, recipientEncryptionPublicKey());
|
||||||
|
return outerEnv;
|
||||||
|
}
|
||||||
|
|
||||||
|
test("missing X-Federation-Origin returns 400", async ({ request }) => {
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
data: { method: "TARGETED", payload: buildFollowTargetedEnvelope("a", "b") },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "MISSING_FED_ORIGIN_HEADER" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("invalid JSON body returns INVALID_PROXY_DATA", async ({ request }) => {
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": SENDER_URL,
|
||||||
|
},
|
||||||
|
data: "{",
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_PROXY_DATA" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("PROXY schema rejects targetUrl without /proxy path", async ({ request }) => {
|
||||||
|
const env = encryptPayload("{}", recipientEncryptionPublicKey());
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: "https://example.com/not-proxy",
|
||||||
|
publicSigningKey: senderKeys.signingPublicKey,
|
||||||
|
publicEncryptionKey: senderKeys.encryptionPublicKey,
|
||||||
|
payload: env,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_PROXY_DATA" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("PROXY rejects missing public keys", async ({ request }) => {
|
||||||
|
const env = encryptPayload("{}", recipientEncryptionPublicKey());
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: `${origin()}/proxy`,
|
||||||
|
payload: env,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_PROXY_DATA" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("PROXY rejects unknown sender", async ({ request }) => {
|
||||||
|
await db.delete(serverRegistry).where(eq(serverRegistry.url, SENDER_URL));
|
||||||
|
|
||||||
|
const env = encryptPayload("{}", recipientEncryptionPublicKey());
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": "https://totally-unknown-peer.example" },
|
||||||
|
data: {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: `${origin()}/proxy`,
|
||||||
|
publicSigningKey: senderKeys.signingPublicKey,
|
||||||
|
publicEncryptionKey: senderKeys.encryptionPublicKey,
|
||||||
|
payload: env,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "UNKNOWN_FEDERATION_SERVER_INTERACTION" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("PROXY rejects signing public key mismatch", async ({ request }) => {
|
||||||
|
const fake = generateEnvKeyPair();
|
||||||
|
const env = encryptPayload("{}", recipientEncryptionPublicKey());
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: `${origin()}/proxy`,
|
||||||
|
publicSigningKey: fake.signingPublicKey,
|
||||||
|
publicEncryptionKey: senderKeys.encryptionPublicKey,
|
||||||
|
payload: env,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INCORRECT_KEYS" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("PROXY rejects encryption public key mismatch", async ({ request }) => {
|
||||||
|
const fake = generateEnvKeyPair();
|
||||||
|
const env = encryptPayload("{}", recipientEncryptionPublicKey());
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: {
|
||||||
|
method: "PROXY",
|
||||||
|
targetUrl: `${origin()}/proxy`,
|
||||||
|
publicSigningKey: senderKeys.signingPublicKey,
|
||||||
|
publicEncryptionKey: fake.encryptionPublicKey,
|
||||||
|
payload: env,
|
||||||
|
},
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INCORRECT_KEYS" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED decrypt failure returns DECRYPT_FAILED", async ({ request }) => {
|
||||||
|
const stranger = generateEnvKeyPair();
|
||||||
|
const garbageWire = encryptPayload(JSON.stringify({ hello: "world" }), new Uint8Array(Buffer.from(stranger.encryptionPublicKey, "base64")));
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: garbageWire },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "DECRYPT_FAILED" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED rejects X-Federation-Target origin mismatch", async ({ request }) => {
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
|
||||||
|
const innerFollow = {
|
||||||
|
federationUrl: SENDER_URL,
|
||||||
|
method: "FEDERATE" as const,
|
||||||
|
following: {
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
createdAt: new Date().toISOString(),
|
||||||
|
followerId,
|
||||||
|
followingId,
|
||||||
|
accepted: false,
|
||||||
|
followerServerUrl: SENDER_URL,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
const innerRaw = JSON.stringify(innerFollow);
|
||||||
|
const followSig = signMessage(innerRaw, new Uint8Array(Buffer.from(senderKeys.signingSecretKey, "base64")));
|
||||||
|
const followEnv = encryptPayload(innerRaw, recipientEncryptionPublicKey());
|
||||||
|
const fedOuterStr = JSON.stringify({
|
||||||
|
method: "FEDERATE",
|
||||||
|
payload: followEnv,
|
||||||
|
signature: followSig,
|
||||||
|
});
|
||||||
|
const targetApi = `${origin()}/api/auth/social/follows`;
|
||||||
|
const wire = JSON.stringify({
|
||||||
|
targetUrl: targetApi,
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": SENDER_URL,
|
||||||
|
"X-Federation-Target": "https://evil.example/api/auth/social/follows",
|
||||||
|
"Origin": SENDER_URL,
|
||||||
|
},
|
||||||
|
body: fedOuterStr,
|
||||||
|
});
|
||||||
|
const outerEnv = encryptPayload(wire, recipientEncryptionPublicKey());
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_TARGETED_DATA" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED rejects unknown federation sender in decrypted headers", async ({ request }) => {
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
|
||||||
|
const innerFollow = {
|
||||||
|
federationUrl: "https://no-registry-entry.example",
|
||||||
|
method: "FEDERATE" as const,
|
||||||
|
following: {
|
||||||
|
id: crypto.randomUUID(),
|
||||||
|
createdAt: new Date().toISOString(),
|
||||||
|
followerId,
|
||||||
|
followingId,
|
||||||
|
accepted: false,
|
||||||
|
followerServerUrl: "https://no-registry-entry.example",
|
||||||
|
},
|
||||||
|
};
|
||||||
|
const innerRaw = JSON.stringify(innerFollow);
|
||||||
|
const fk = generateEnvKeyPair();
|
||||||
|
const followSig = signMessage(innerRaw, new Uint8Array(Buffer.from(fk.signingSecretKey, "base64")));
|
||||||
|
const followEnv = encryptPayload(innerRaw, recipientEncryptionPublicKey());
|
||||||
|
const fedOuterStr = JSON.stringify({
|
||||||
|
method: "FEDERATE",
|
||||||
|
payload: followEnv,
|
||||||
|
signature: followSig,
|
||||||
|
});
|
||||||
|
const targetApi = `${origin()}/api/auth/social/follows`;
|
||||||
|
const wire = JSON.stringify({
|
||||||
|
targetUrl: targetApi,
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": "https://no-registry-entry.example",
|
||||||
|
"X-Federation-Target": targetApi,
|
||||||
|
"Origin": "https://no-registry-entry.example",
|
||||||
|
},
|
||||||
|
body: fedOuterStr,
|
||||||
|
});
|
||||||
|
const outerEnv = encryptPayload(wire, recipientEncryptionPublicKey());
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "UNKNOWN_FEDERATION_SERVER_INTERACTION" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED rejects blacklisted sender", async ({ request }) => {
|
||||||
|
await seedBlacklist(SENDER_URL);
|
||||||
|
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followerId,
|
||||||
|
email: `${followerId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followingId,
|
||||||
|
email: `${followingId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
|
||||||
|
const outerEnv = buildFollowTargetedEnvelope(followerId, followingId);
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "BLACKLISTED_FEDERATION_SERVER" });
|
||||||
|
|
||||||
|
await db.delete(user).where(eq(user.id, followerId));
|
||||||
|
await db.delete(user).where(eq(user.id, followingId));
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED rejects invalid follow signature", async ({ request }) => {
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followerId,
|
||||||
|
email: `${followerId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followingId,
|
||||||
|
email: `${followingId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
|
||||||
|
const bogusSig = Buffer.alloc(64, 7).toString("base64");
|
||||||
|
const outerEnv = buildFollowTargetedEnvelope(followerId, followingId, bogusSig);
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(403);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "INVALID_SIGNATURE" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED FEDERATE_FOLLOW inserts follow and returns PROXY_RESPONSE", async ({ request }) => {
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followerId,
|
||||||
|
email: `${followerId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followingId,
|
||||||
|
email: `${followingId}@proxy-test.invalid`,
|
||||||
|
isPrivate: false,
|
||||||
|
});
|
||||||
|
|
||||||
|
const outerEnv = buildFollowTargetedEnvelope(followerId, followingId);
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv },
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(200);
|
||||||
|
const body = await res.json();
|
||||||
|
expect(body.method).toBe("PROXY_RESPONSE");
|
||||||
|
expect(body.status).toBe("acknowledged");
|
||||||
|
expect(body.signature).toBeDefined();
|
||||||
|
expect(body.data).toBeDefined();
|
||||||
|
|
||||||
|
const ackPlain = decryptPayload(body.data, new Uint8Array(Buffer.from(senderKeys.encryptionSecretKey, "base64")));
|
||||||
|
expect(
|
||||||
|
verifySignature(
|
||||||
|
ackPlain,
|
||||||
|
body.signature,
|
||||||
|
new Uint8Array(Buffer.from(process.env.FEDERATION_PUBLIC_KEY!, "base64")),
|
||||||
|
),
|
||||||
|
).toBe(true);
|
||||||
|
|
||||||
|
const innerAck = JSON.parse(ackPlain) as {
|
||||||
|
following: { followerId: string; followingId: string };
|
||||||
|
};
|
||||||
|
expect(innerAck.following.followerId).toBe(followerId);
|
||||||
|
expect(innerAck.following.followingId).toBe(followingId);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("TARGETED duplicate FEDERATE_FOLLOW returns 409", async ({ request }) => {
|
||||||
|
const followerId = crypto.randomUUID();
|
||||||
|
const followingId = crypto.randomUUID();
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followerId,
|
||||||
|
email: `${followerId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
await seedMinimalUser({
|
||||||
|
id: followingId,
|
||||||
|
email: `${followingId}@proxy-test.invalid`,
|
||||||
|
});
|
||||||
|
|
||||||
|
const outerEnv1 = buildFollowTargetedEnvelope(followerId, followingId);
|
||||||
|
const r1 = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv1 },
|
||||||
|
});
|
||||||
|
expect(r1.status()).toBe(200);
|
||||||
|
|
||||||
|
const outerEnv2 = buildFollowTargetedEnvelope(followerId, followingId);
|
||||||
|
const r2 = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: outerEnv2 },
|
||||||
|
});
|
||||||
|
expect(r2.status()).toBe(409);
|
||||||
|
expect(await r2.json()).toMatchObject({ code: "FOLLOW_ALREADY_EXISTS" });
|
||||||
|
});
|
||||||
|
|
||||||
|
test("rate limits proxy requests per X-Federation-Origin (429)", async ({ request }) => {
|
||||||
|
const stranger = generateEnvKeyPair();
|
||||||
|
let saw429 = false;
|
||||||
|
for (let i = 0; i < 105; i++) {
|
||||||
|
const garbageWire = encryptPayload(JSON.stringify({ n: i }), new Uint8Array(Buffer.from(stranger.encryptionPublicKey, "base64")));
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: garbageWire },
|
||||||
|
});
|
||||||
|
if (res.status() === 429) {
|
||||||
|
saw429 = true;
|
||||||
|
const body = await res.json();
|
||||||
|
expect(body.code).toBe("RATE_LIMITED");
|
||||||
|
expect(res.headers()["retry-after"]).toBeDefined();
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
expect(res.status()).toBe(400);
|
||||||
|
expect((await res.json()).code).toBe("DECRYPT_FAILED");
|
||||||
|
}
|
||||||
|
expect(saw429).toBe(true);
|
||||||
|
});
|
||||||
|
|
||||||
|
test("request larger than PROXY_MAX_BODY_BYTES returns 413", async ({ request }) => {
|
||||||
|
const huge = "x".repeat(260_000);
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
"X-Federation-Origin": SENDER_URL,
|
||||||
|
},
|
||||||
|
data: huge,
|
||||||
|
});
|
||||||
|
expect(res.status()).toBe(413);
|
||||||
|
expect(await res.json()).toMatchObject({ code: "PAYLOAD_TOO_LARGE" });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Full round-trip flow — decrypt → registered-sender check → nonce echo —
|
||||||
|
// against the real `/proxy` route on this server (no stubs involved).
|
||||||
|
test("TARGETED PING returns pong with the same nonce", async ({ request }) => {
|
||||||
|
const nonce = crypto.randomUUID();
|
||||||
|
const inner = JSON.stringify({ method: "PING", nonce });
|
||||||
|
const env = encryptPayload(inner, recipientEncryptionPublicKey());
|
||||||
|
|
||||||
|
const res = await request.post("/proxy", {
|
||||||
|
headers: { "X-Federation-Origin": SENDER_URL },
|
||||||
|
data: { method: "TARGETED", payload: env },
|
||||||
|
});
|
||||||
|
|
||||||
|
expect(res.status()).toBe(200);
|
||||||
|
const body = await res.json();
|
||||||
|
expect(body.method).toBe("PROXY_RESPONSE");
|
||||||
|
expect(body.status).toBe("pong");
|
||||||
|
expect(body.nonce).toBe(nonce);
|
||||||
|
});
|
||||||
|
|
||||||
|
// The end-to-end PROXY relay flow (A direct → B fails → A → C proxy → B → C → A)
|
||||||
|
// is verified by `tests/integration/proxy-chain.ts` against the dockerized 3-instance
|
||||||
|
// federation cluster. It can't be faithfully modelled with a stub here, because the
|
||||||
|
// failover decision lives inside `federationFetch` on the sender side and only
|
||||||
|
// triggers when the target is *genuinely* unreachable for the sender but reachable
|
||||||
|
// via a real proxy peer.
|
||||||
Loading…
Add table
Reference in a new issue