sipher/tests/docker/setup-discovery.ts
Nixyan 660c17b319 feat: add client-side identity system, rate limiting, proxy hardening, and full test suite
### Major changes

- **Client-side identity** — New session key store (`sessionKey.ts`) backed by
  `sessionStorage` with a module-level caching, a `crypto.subtle` cache, a `useIdentityLock`
  hook for decrypt-once signing, `followSignature.ts` for signed follows, and
  two new UI modals (`IdentityBackup.tsx`, `UnlockIdentityModal.tsx`).
  `CreateIdentity.tsx` is rewritten to generate BIP-39 mnemonics and encrypt the
  Ed25519 keypair with AES-256-GCM via PBKDF2 (600k iterations) before storing
  in IndexedDB.

- **Rate limiting** — New `rate-limit-config.ts` and `rate-limit.ts` provide a
  per-IP sliding-window rate limiter backed by Redis. All external-facing routes
  (`/discover`, `/discover/rotate/*`, `/proxy`, social API endpoints) now have
  conservative defaults wired into the custom HTTP server before requests reach
  Next.js handlers.

- **Proxy route hardening** — The `/proxy` route now enforces a 256 KB payload
  limit (HTTP 413), validates JSON before parsing, applies a per-origin rate
  limit (100 req/min), and imports the `blocks` table to reject requests from
  blocked servers.

- **Docker integration-test cluster** — New `Dockerfile`, `.dockerignore`, and
  `tests/docker-compose.yml` orchestrate three SiPher instances (A, B, C) plus
  shared PostgreSQL and Redis. Key generation (`generate-keys.ts`) and discovery
  setup (`setup-discovery.ts`) scripts automate cluster bootstrap. Three example
  env files document required per-instance configuration.

- **Full test suite overhaul** — Replaces the old attack/auth/discover/key/proxy
  tests with a structured suite:
  * `tests/federation/` — Keytools unit tests + key-rotation e2e test
  * `tests/proxy/` — Proxy relay e2e tests (single-server validation)
  * `tests/integration/` — Multi-instance integration tests for discover,
    proxy-chain relay, and federated post delivery via BullMQ
  * `tests/helpers/` — Reusable DB, identity, and auth-user utilities
  * Playwright config updated to match new file conventions
  * Unused helpers (`tests/helpers/queue.ts`) removed

- **Social plugin endpoints** — Rewritten `follows.ts`, `blocks.ts`, `mutes.ts`,
  and `posts.ts` with proper federation integration. `social.ts` gains helpers
  for looking up posts by federation URL.

### Minor changes

- **README** — Expanded from a 42-line stub to a full architecture guide with
  tables for every layer (auth, DB, queues, storage, real-time), API route
  documentation, setup instructions, environment variables, test coverage, and
  the updated roadmap.

- **Federation helpers** — `keytools.ts` refactors imports and cleans up the public surface.
  `fetch.ts`, `registry.ts`, and `proxy-helpers/federated-post.ts` pick up small
  improvements. `PostFederationSchema` simplifies its encryption type assertion.

- **Plugin infrastructure** — Oven plugin schema and server index gain minor
  refactors. Social client adds a `muteUser` method.

- **UI components** — `switch.tsx` and `tooltip.tsx` rewritten for Radix v2 /
  Tailwind 4; `accordion.tsx`, `dropdown-menu.tsx`, `form`, `button`, `card` get
  minor consistency fixes. `dialog.tsx` removes unused `DialogHeader`.

- **Server bootstrap** — `server.ts` imports DB schema before `instrumentation`
  for correct Drizzle initialization, rate-limiting routes are wired, and CORS
  allows federation origins. `auth.ts` regenerates Oven and social plugin schemas.

- **Dependencies** — Added `@noble/ciphers` and `@noble/hashes` (crypto
  primitives). Removed `@signalapp/libsignal-client`, `base58-js`, `nanostores`,
  `tweetnacl-util`, `dexie-react-hooks`, `socket.io-client`. Updated all Better
  Auth packages to 1.6.11, BullMQ to 5.76.10, and various dev deps across the
  board.

- **.gitignore** — Added `/audits` and `tests/docker/*.env` to prevent secret
  leakage.

- **DB schema** — `blocks` table imported in `src/lib/db/schema/index.ts`.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-18 09:48:42 -03:00

115 lines
4 KiB
TypeScript

export {};
/**
* Sets up mutual discovery between all three Sipher federation instances.
*
* Each instance must know about the others before integration tests can run.
* This script performs the minimum calls to achieve a full mesh:
*
* A → discover B (A stores B, B stores A via REGISTER callback)
* A → discover C (A stores C, C stores A)
* B → discover C (B stores C, C stores B)
*
* It does this by issuing REGISTER requests to each server for each of the
* other two, which is equivalent to what discoverAndRegister() does internally.
*
* Usage (from within the Docker network):
* docker compose -f tests/docker-compose.yml run --rm setup-discovery
* # or directly:
* docker compose -f tests/docker-compose.yml run --rm test-runner tests/docker/setup-discovery.ts
*
* URLs default to the three Docker service names but can be overridden:
* SIPHER_A_URL=http://sipher-a:3000 \
* SIPHER_B_URL=http://sipher-b:3001 \
* SIPHER_C_URL=http://sipher-c:3002 \
* docker compose -f tests/docker-compose.yml run --rm test-runner tests/docker/setup-discovery.ts
*/
const URLS = [
process.env.SIPHER_A_URL ?? "http://sipher-a:3000",
process.env.SIPHER_B_URL ?? "http://sipher-b:3001",
process.env.SIPHER_C_URL ?? "http://sipher-c:3002",
];
const TIMEOUT_MS = 15_000;
interface DiscoverResponse {
url: string;
publicKey: string;
encryptionPublicKey: string;
}
async function fetchInfo(url: string): Promise<DiscoverResponse> {
const res = await fetch(`${url}/discover`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
if (!res.ok) throw new Error(`GET ${url}/discover returned ${res.status}`);
const body = await res.json() as DiscoverResponse;
if (!body.url || !body.publicKey || !body.encryptionPublicKey) {
throw new Error(`${url}/discover returned incomplete keys`);
}
return body;
}
async function register(targetUrl: string, peer: DiscoverResponse) {
const res = await fetch(`${targetUrl}/discover`, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
method: "REGISTER",
url: peer.url,
publicKey: peer.publicKey,
encryptionPublicKey: peer.encryptionPublicKey,
}),
signal: AbortSignal.timeout(TIMEOUT_MS),
});
const body = await res.json().catch(() => ({}));
if (!res.ok) {
throw new Error(`REGISTER ${peer.url} on ${targetUrl} failed (${res.status}): ${JSON.stringify(body)}`);
}
return body;
}
// ── Fetch all three instances ────────────────────────────────────────────────
console.log("Fetching instance keys…");
const infos = await Promise.all(URLS.map(fetchInfo));
for (const info of infos) {
console.log(` ${info.url} signing=${info.publicKey.slice(0, 12)}`);
}
// ── Register each instance with every other instance ────────────────────────
// 6 POST calls: for every ordered pair (A→B, A→C, B→A, B→C, C→A, C→B).
// When server X receives REGISTER from Y it fetches Y's /discover to validate,
// so each call also exercises the full handshake.
console.log("\nRegistering peers…");
let ok = 0;
let fail = 0;
for (let i = 0; i < infos.length; i++) {
for (let j = 0; j < infos.length; j++) {
if (i === j) continue;
const target = URLS[i];
const peer = infos[j];
try {
await register(target, peer);
console.log(`${peer.url}${target}`);
ok++;
} catch (err) {
console.error(`${peer.url}${target}: ${err instanceof Error ? err.message : err}`);
fail++;
}
}
}
// ── Summary ──────────────────────────────────────────────────────────────────
console.log(`\n${ok} registration(s) succeeded, ${fail} failed.`);
if (fail > 0) {
console.error("Some registrations failed — check that all instances are healthy and reachable.");
process.exit(1);
}
console.log("Mutual discovery complete. All instances know each other.");