diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-08-13 03:56:30 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-08-13 03:56:30 +0200 |
| commit | f0248975908ad670fa8a820f865bf22ea8d0172d (patch) | |
| tree | f4af64d36cacaccb4f6d13436e001aeb57e861e3 /packages/meshbay-hub/src/meshbay_hub | |
| parent | 35130e5528a52161630fd1c93572e1b2b7cd911b (diff) | |
| download | meshbay-f0248975908ad670fa8a820f865bf22ea8d0172d.tar.gz | |
feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth
Baseline commit capturing in-progress Phase 12 work that was already present
in the working tree (uncommitted) before the Phase 11.5 security remediation
begins. Committed as-is, without review or modification, so that remediation
changes arrive as a separable diff.
Contents: BundleStore (P2P GEK + keypair bundles), password split
(auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped
JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin
challenge-response, node local admin UI rewrite, browser key persistence.
Not authored in this session — captured to establish a baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub')
16 files changed, 1172 insertions, 298 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py index 88e231a..164885d 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py @@ -211,6 +211,7 @@ async def admin_list_groups( "name": g.name, "admin_id": g.admin_id, "visibility": g.visibility, + "description": g.description or "", "status": g.status, "created_at": g.created_at.isoformat(), "member_count": mc, @@ -265,25 +266,30 @@ async def admin_list_logs( offset: int = 0, limit: int = Query(default=50, le=200), ): - query = select(IPLog).order_by(IPLog.timestamp.desc()) + query = ( + select(IPLog, User.username) + .outerjoin(User, IPLog.user_id == User.id) + .order_by(IPLog.timestamp.desc()) + ) if user_id: query = query.where(IPLog.user_id == user_id) if event: query = query.where(IPLog.event == event) query = query.offset(offset).limit(limit) result = await db.execute(query) - logs = result.scalars().all() + rows = result.all() return { "logs": [ { "id": lg.id, "user_id": lg.user_id, + "username": uname or "", "event": lg.event, "ip_address": lg.ip_address, "detail": lg.detail, "timestamp": lg.timestamp.isoformat(), } - for lg in logs + for lg, uname in rows ], } diff --git a/packages/meshbay-hub/src/meshbay_hub/api/deps.py b/packages/meshbay-hub/src/meshbay_hub/api/deps.py index addba30..1bf57a4 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/deps.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/deps.py @@ -1,5 +1,10 @@ """ FastAPI shared dependencies — injected via Depends(). + +JWT scope enforcement: + - "user" scope (browser login): full access to all endpoints + - "node" scope (Ed25519 daemon auth): read-only group access + node operations + Node-scoped tokens CANNOT create/delete groups or manage membership. """ from fastapi import Depends, Header, HTTPException, status @@ -18,20 +23,13 @@ def set_admin_usernames(usernames: list[str]) -> None: _admin_usernames = set(usernames) -async def get_current_user( - authorization: str = Header(...), - db: AsyncSession = Depends(get_db), -) -> User: - """ - Verify the JWT bearer token and return the User from the database. - Node clients: verified locally with hub PK — no DB round-trip needed. - Hub API (web): must confirm user still exists and is active. - """ +async def _decode_token(authorization: str = Header(...)) -> dict: + """Decode and verify JWT bearer token. Returns full payload.""" try: scheme, token = authorization.split(None, 1) if scheme.lower() != "bearer": raise ValueError - payload = decode_access_token(token) + return decode_access_token(token) except Exception: raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, @@ -39,6 +37,15 @@ async def get_current_user( headers={"WWW-Authenticate": "Bearer"}, ) + +async def get_current_user( + payload: dict = Depends(_decode_token), + db: AsyncSession = Depends(get_db), +) -> User: + """ + Verify the JWT bearer token and return the User from the database. + Accepts both user-scoped and node-scoped tokens. + """ result = await db.execute( select(User).where(User.id == payload["sub"])) user = result.scalar_one_or_none() @@ -52,6 +59,19 @@ async def get_current_user( return user +async def require_user_scope( + payload: dict = Depends(_decode_token), + current_user: User = Depends(get_current_user), +) -> User: + """Reject node-scoped tokens — only browser (user-scope) can mutate groups.""" + if payload.get("scope") == "node": + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail="Node-scoped token cannot perform this operation — use browser", + ) + return current_user + + async def require_moderator( current_user: User = Depends(get_current_user), ) -> User: diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py index e0ea016..88af764 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py @@ -5,10 +5,10 @@ from pydantic import BaseModel from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession -from meshbay_hub.api.deps import get_current_user +from meshbay_hub.api.deps import get_current_user, require_user_scope from meshbay_hub.db.engine import get_db from meshbay_hub.db.models import ( - FederatedGroup, GEKBundle, Group, GroupMember, + FederatedGroup, Group, GroupMember, IPLog, SwarmSource, User, ) @@ -37,6 +37,7 @@ async def my_groups( "join_policy": g.join_policy, "created_at": g.created_at.isoformat(), "is_admin": g.admin_id == current_user.id, + "description": g.description or "", } for g in groups ] @@ -56,6 +57,8 @@ async def group_online_nodes( group = await db.get(Group, group_id) if not group: raise HTTPException(status_code=404, detail="Group not found") + if group.status != "active": + raise HTTPException(status_code=403, detail="Group is suspended") node_ids = get_online_nodes_for_group(group_id) nodes = [] @@ -85,6 +88,7 @@ async def list_public_groups( groups = [ { "id": g.id, "name": g.name, "join_policy": g.join_policy, + "description": g.description or "", "created_at": g.created_at.isoformat(), "source": "local", } for g in local @@ -193,7 +197,7 @@ async def group_members( async def join_group( group_id: str, request: Request, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_user_scope), db: AsyncSession = Depends(get_db), ): group = await db.get(Group, group_id) @@ -219,26 +223,23 @@ class GroupCreateRequest(BaseModel): name: str visibility: str = "private" # public|private join_policy: str = "invite" # open|request|invite - - -class GEKBundleRequest(BaseModel): - pk_eph_b64: str - nonce_b64: str - wrapped_b64: str + description: str | None = None @router.post("", status_code=201) async def create_group( body: GroupCreateRequest, request: Request, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_user_scope), db: AsyncSession = Depends(get_db), ): + desc = (body.description or "")[:512] if body.description else None group = Group( name=body.name, admin_id=current_user.id, visibility=body.visibility, join_policy=body.join_policy, + description=desc, ) db.add(group) await db.flush() # get group.id @@ -251,12 +252,11 @@ async def create_group( return {"group_id": group.id, "name": group.name} -@router.post("/{group_id}/members/{username}/gek", status_code=201) -async def store_gek_bundle( +@router.post("/{group_id}/members/{username}", status_code=201) +async def add_group_member( group_id: str, username: str, - body: GEKBundleRequest, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_user_scope), db: AsyncSession = Depends(get_db), ): group = await db.get(Group, group_id) @@ -270,26 +270,11 @@ async def store_gek_bundle( if not target: raise HTTPException(status_code=404, detail="User not found") - # Upsert GEK bundle - existing = await db.get(GEKBundle, (group_id, target.id)) new_member = False - if existing: - existing.pk_eph_b64 = body.pk_eph_b64 - existing.nonce_b64 = body.nonce_b64 - existing.wrapped_b64 = body.wrapped_b64 - else: - db.add(GEKBundle( - group_id=group_id, - user_id=target.id, - pk_eph_b64=body.pk_eph_b64, - nonce_b64=body.nonce_b64, - wrapped_b64=body.wrapped_b64, - )) - # Add member if not already in group - mem = await db.get(GroupMember, (group_id, target.id)) - if not mem: - db.add(GroupMember(group_id=group_id, user_id=target.id)) - new_member = True + mem = await db.get(GroupMember, (group_id, target.id)) + if not mem: + db.add(GroupMember(group_id=group_id, user_id=target.id)) + new_member = True if new_member: from meshbay_hub.api.notifications import create_notification @@ -303,26 +288,26 @@ async def store_gek_bundle( return {"status": "stored", "group_id": group_id, "username": username} -@router.get("/{group_id}/gek") -async def get_my_gek_bundle( +@router.delete("/{group_id}") +async def delete_group( group_id: str, - current_user: User = Depends(get_current_user), + request: Request, + current_user: User = Depends(require_user_scope), db: AsyncSession = Depends(get_db), ): group = await db.get(Group, group_id) if not group: raise HTTPException(status_code=404, detail="Group not found") + if group.admin_id != current_user.id: + raise HTTPException(status_code=403, detail="Only the group creator can delete") - bundle = await db.get(GEKBundle, (group_id, current_user.id)) - if not bundle: - raise HTTPException(status_code=404, detail="No GEK bundle for this user in this group") - - return { - "group_id": group_id, - "pk_eph_b64": bundle.pk_eph_b64, - "nonce_b64": bundle.nonce_b64, - "wrapped_b64": bundle.wrapped_b64, - } + from sqlalchemy import delete as sa_delete + await db.execute(sa_delete(GroupMember).where(GroupMember.group_id == group_id)) + db.add(IPLog(user_id=current_user.id, event="group_delete", + ip_address=_ip(request), detail=group.name)) + await db.delete(group) + await db.commit() + return {"status": "deleted", "group_id": group_id} def _ip(request: Request) -> str: diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py index b970aa8..321e43c 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py @@ -1,15 +1,84 @@ """Node endpoints — /v1/nodes/*""" +import base64 +import time + +from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey +from cryptography.exceptions import InvalidSignature from fastapi import APIRouter, Depends, HTTPException, Request from pydantic import BaseModel +from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession +from meshbay_hub.auth import issue_access_token from meshbay_hub.api.deps import get_current_user +from meshbay_hub.api.middleware import limiter from meshbay_hub.db.engine import get_db -from meshbay_hub.db.models import IPLog, Node, User +from meshbay_hub.db.models import GroupMember, IPLog, Node, User router = APIRouter(prefix="/v1/nodes", tags=["nodes"]) +NODE_AUTH_TIMESTAMP_WINDOW = 60 # seconds + + +class NodeAuthRequest(BaseModel): + username: str + timestamp: int # unix epoch seconds + signature: str # base64 Ed25519 signature + + +@router.post("/auth") +@limiter.limit("10/minute") +async def node_auth( + body: NodeAuthRequest, + request: Request, + db: AsyncSession = Depends(get_db), +): + """Authenticate a node daemon via Ed25519 challenge-response. Returns node-scoped JWT.""" + now = int(time.time()) + if abs(now - body.timestamp) > NODE_AUTH_TIMESTAMP_WINDOW: + raise HTTPException(status_code=401, detail="Timestamp too old or too far in the future") + + result = await db.execute(select(User).where(User.username == body.username)) + user = result.scalar_one_or_none() + if not user: + raise HTTPException(status_code=401, detail="Invalid credentials") + if user.status != "active": + raise HTTPException(status_code=403, detail=f"Account {user.status}") + + if not user.pk_node_ed25519: + raise HTTPException( + status_code=401, + detail="No node key registered — link your node from the browser first", + ) + + message = f"meshbay:node_auth:{body.username}:{body.timestamp}".encode() + try: + pk_raw = base64.b64decode(user.pk_node_ed25519) + pk = Ed25519PublicKey.from_public_bytes(pk_raw) + sig = base64.b64decode(body.signature) + pk.verify(sig, message) + except (InvalidSignature, Exception): + db.add(IPLog(event="node_auth_fail", ip_address=_ip(request), detail=body.username)) + await db.commit() + raise HTTPException(status_code=401, detail="Invalid signature") + + memberships = await db.execute( + select(GroupMember.group_id).where(GroupMember.user_id == user.id)) + group_ids = [gid for (gid,) in memberships.all()] + + access_token = issue_access_token( + user.id, user.pk_node_ed25519, ttl=3600, groups=group_ids, scope="node") + + db.add(IPLog(user_id=user.id, event="node_auth", ip_address=_ip(request))) + await db.commit() + + return { + "access_token": access_token, + "token_type": "bearer", + "expires_in": 3600, + } + class NodeAnnounceRequest(BaseModel): pk_node: str diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py index 2c2eede..53238de 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/users.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py @@ -1,5 +1,6 @@ """User endpoints — /v1/users/*""" +import base64 import uuid from datetime import datetime, timezone, timedelta @@ -24,7 +25,7 @@ from meshbay_hub.api.middleware import limiter from meshbay_hub.config import HubConfig from meshbay_hub.db.engine import get_db from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User -from meshbay_hub.api.deps import get_current_user +from meshbay_hub.api.deps import get_current_user, require_user_scope router = APIRouter(prefix="/v1/users", tags=["users"]) @@ -46,10 +47,10 @@ def _refresh_ttl() -> int: class RegisterRequest(BaseModel): username: str email: str - password: str + password: str | None = None # deprecated — legacy native clients + auth_key: str | None = None # PBKDF2-derived, new clients pk_user_ed25519: str # base64 raw 32B pk_user_x25519: str # base64 raw 32B - keypair_bundle: str | None = None # AES-GCM encrypted bundle (web clients) @field_validator("username") @classmethod @@ -61,17 +62,11 @@ class RegisterRequest(BaseModel): raise ValueError("username: only letters, digits, -, _, .") return v - @field_validator("password") - @classmethod - def password_strength(cls, v: str) -> str: - if len(v) < 8: - raise ValueError("password must be at least 8 characters") - return v - class LoginRequest(BaseModel): username: str - password: str + password: str | None = None # legacy (raw password) for migration + auth_key: str | None = None # PBKDF2-derived auth key (new scheme) class RefreshRequest(BaseModel): @@ -92,18 +87,23 @@ async def register( if existing.scalar_one_or_none(): raise HTTPException(status_code=409, detail="Username already taken") - pw_hash, pw_salt = hash_password(body.password) + credential = body.auth_key or body.password + if not credential: + raise HTTPException(status_code=400, detail="auth_key or password required") + + pw_hash, pw_salt = hash_password(credential) + # auth_key → pw_version 3 (password split); raw password → pw_version 2 (legacy) + pw_ver = current_pw_version() if body.auth_key else 2 hub_id = _cfg.identity.id if _cfg else "meshbay.org" user = User( username=body.username, email=encrypt_email(body.email), pw_hash=pw_hash, pw_salt=pw_salt, - pw_version=current_pw_version(), + pw_version=pw_ver, pk_ed25519=body.pk_user_ed25519, pk_x25519=body.pk_user_x25519, hub_id=hub_id, - keypair_bundle=body.keypair_bundle, ) db.add(user) db.add(IPLog( @@ -136,18 +136,52 @@ async def login( user = result.scalar_one_or_none() ip = _client_ip(request) - if not user or not verify_password( - body.password, user.pw_hash, user.pw_salt, version=user.pw_version - ): + + if not body.auth_key and not body.password: + raise HTTPException(status_code=401, detail="No credentials provided") + + if not user: db.add(IPLog(event="login_fail", ip_address=ip, detail=body.username)) await db.commit() raise HTTPException(status_code=401, detail="Invalid credentials") + if user.pw_version >= 3: + # New scheme: verify auth_key + if not body.auth_key or not verify_password( + body.auth_key, user.pw_hash, user.pw_salt, version=user.pw_version + ): + db.add(IPLog(event="login_fail", ip_address=ip, detail=body.username)) + await db.commit() + raise HTTPException(status_code=401, detail="Invalid credentials") + else: + # Legacy scheme: need raw password + if not body.password: + raise HTTPException(status_code=401, detail="auth_upgrade_required") + if not verify_password( + body.password, user.pw_hash, user.pw_salt, version=user.pw_version + ): + db.add(IPLog(event="login_fail", ip_address=ip, detail=body.username)) + await db.commit() + raise HTTPException(status_code=401, detail="Invalid credentials") + # Migrate to new scheme if auth_key provided alongside password + if body.auth_key: + new_hash, new_salt = hash_password(body.auth_key) + user.pw_hash = new_hash + user.pw_salt = new_salt + user.pw_version = current_pw_version() + elif user.pw_version < 2: + # Legacy rehash: upgrade Argon2 params within the password scheme (v1 -> v2) + new_hash, new_salt = hash_password(body.password) + user.pw_hash = new_hash + user.pw_salt = new_salt + user.pw_version = 2 + if user.status != "active": raise HTTPException(status_code=403, detail=f"Account {user.status}") - if pw_needs_rehash(user.pw_version): - new_hash, new_salt = hash_password(body.password) + # Rehash within the auth_key scheme if Argon2 params upgraded beyond v3 + if user.pw_version >= 3 and pw_needs_rehash(user.pw_version): + new_hash, new_salt = hash_password(body.auth_key) user.pw_hash = new_hash user.pw_salt = new_salt user.pw_version = current_pw_version() @@ -168,15 +202,12 @@ async def login( db.add(IPLog(user_id=user.id, event="login", ip_address=ip)) await db.commit() - resp = { + return { "access_token": access_token, "refresh_token": raw_rt, "token_type": "bearer", "expires_in": _ttl(), } - if user.keypair_bundle: - resp["keypair_bundle"] = user.keypair_bundle # encrypted, for web clients - return resp @router.post("/token/refresh") @@ -248,6 +279,64 @@ async def get_current_user_info( } +class NodeKeyRequest(BaseModel): + pk_node_ed25519: str # base64 raw 32B Ed25519 public key + + +@router.put("/me/node_key") +async def register_node_key( + body: NodeKeyRequest, + current_user: User = Depends(require_user_scope), + db: AsyncSession = Depends(get_db), +): + """Link a node daemon's Ed25519 public key to the operator's account.""" + try: + raw = base64.b64decode(body.pk_node_ed25519) + if len(raw) != 32: + raise ValueError + except Exception: + raise HTTPException(status_code=400, detail="Invalid Ed25519 public key (need 32 bytes base64)") + + current_user.pk_node_ed25519 = body.pk_node_ed25519 + await db.commit() + return {"status": "stored", "pk_node_ed25519": body.pk_node_ed25519} + + +class RotateKeysRequest(BaseModel): + pk_user_ed25519: str # base64 raw 32B + pk_user_x25519: str # base64 raw 32B + + +@router.put("/me/keys") +async def rotate_browser_keys( + body: RotateKeysRequest, + current_user: User = Depends(require_user_scope), + db: AsyncSession = Depends(get_db), +): + for field, label in [ + (body.pk_user_ed25519, "Ed25519"), + (body.pk_user_x25519, "X25519"), + ]: + try: + raw = base64.b64decode(field) + if len(raw) != 32: + raise ValueError + except Exception: + raise HTTPException( + status_code=400, + detail=f"Invalid {label} public key (need 32 bytes base64)", + ) + + current_user.pk_ed25519 = body.pk_user_ed25519 + current_user.pk_x25519 = body.pk_user_x25519 + await db.commit() + return { + "status": "updated", + "pk_ed25519": body.pk_user_ed25519, + "pk_x25519": body.pk_user_x25519, + } + + @router.get("/{username}/pubkeys") async def get_user_pubkeys( username: str, @@ -258,12 +347,15 @@ async def get_user_pubkeys( target = result.scalar_one_or_none() if not target: raise HTTPException(status_code=404, detail="User not found") - return { + resp = { "user_id": target.id, "username": target.username, "pk_ed25519": target.pk_ed25519, "pk_x25519": target.pk_x25519, } + if target.pk_node_ed25519: + resp["pk_node_ed25519"] = target.pk_node_ed25519 + return resp def _client_ip(request: Request) -> str: diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py index 11ad112..563a1eb 100644 --- a/packages/meshbay-hub/src/meshbay_hub/auth.py +++ b/packages/meshbay-hub/src/meshbay_hub/auth.py @@ -30,8 +30,9 @@ _ARGON2_KEY_LEN = 32 _ARGON2_VERSIONS = { 1: {"iterations": 3, "memory_cost": 65536}, # 64 MB — initial 2: {"iterations": 3, "memory_cost": 262144}, # 256 MB — production target + 3: {"iterations": 3, "memory_cost": 262144}, # 256 MB — auth_key input (password split) } -_ARGON2_CURRENT_VERSION = 2 +_ARGON2_CURRENT_VERSION = 3 # Module-level hub keypair (loaded once at startup) _hub_sk_pem: bytes | None = None @@ -133,11 +134,13 @@ def issue_access_token( pk_user: str, ttl: int = 3600, groups: list[str] | None = None, + scope: str = "user", ) -> str: """ Issue a signed JWT access token. Includes jti (UUID4) — required to prevent replay and enable revocation. Includes groups — list of group_ids the user is a member of (node-side authz). + scope: "user" (browser, full access) or "node" (daemon, restricted). """ if _hub_sk_pem is None: raise RuntimeError("Hub keypair not loaded") @@ -151,6 +154,7 @@ def issue_access_token( "iat": now, "exp": now + ttl, "groups": groups or [], + "scope": scope, } return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA") diff --git a/packages/meshbay-hub/src/meshbay_hub/db/__init__.py b/packages/meshbay-hub/src/meshbay_hub/db/__init__.py index 5ef1d3c..62e5388 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/__init__.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/__init__.py @@ -1,9 +1,9 @@ """Hub database layer.""" from .engine import init_db, close_db, get_db -from .models import Base, User, Node, Group, GroupMember, GEKBundle, RefreshToken, IPLog +from .models import Base, User, Node, Group, GroupMember, RefreshToken, IPLog __all__ = [ "init_db", "close_db", "get_db", "Base", "User", "Node", "Group", "GroupMember", - "GEKBundle", "RefreshToken", "IPLog", + "RefreshToken", "IPLog", ] diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py index 779efdc..a59a3d1 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py @@ -63,14 +63,12 @@ def upgrade() -> None: ) op.create_index('ix_content_reports_group', 'content_reports', ['group_id'], unique=False) op.create_index('ix_content_reports_hash', 'content_reports', ['content_hash'], unique=False) - op.add_column('users', sa.Column('keypair_bundle', sa.Text(), nullable=True)) # ### end Alembic commands ### def downgrade() -> None: """Downgrade schema.""" # ### commands auto generated by Alembic - please adjust! ### - op.drop_column('users', 'keypair_bundle') op.drop_index('ix_content_reports_hash', table_name='content_reports') op.drop_index('ix_content_reports_group', table_name='content_reports') op.drop_table('content_reports') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py index d4a9aa6..5192eb8 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/d28b9caf9f07_initial_schema.py @@ -84,17 +84,6 @@ def upgrade() -> None: sa.UniqueConstraint('token_hash') ) op.create_index('ix_refresh_tokens_hash', 'refresh_tokens', ['token_hash'], unique=False) - op.create_table('gek_bundles', - sa.Column('group_id', sa.String(length=36), nullable=False), - sa.Column('user_id', sa.String(length=36), nullable=False), - sa.Column('pk_eph_b64', sa.String(length=64), nullable=False), - sa.Column('nonce_b64', sa.String(length=32), nullable=False), - sa.Column('wrapped_b64', sa.String(length=128), nullable=False), - sa.Column('stored_at', sa.DateTime(timezone=True), nullable=False), - sa.ForeignKeyConstraint(['group_id'], ['groups.id'], ), - sa.ForeignKeyConstraint(['user_id'], ['users.id'], ), - sa.PrimaryKeyConstraint('group_id', 'user_id') - ) op.create_table('group_members', sa.Column('group_id', sa.String(length=36), nullable=False), sa.Column('user_id', sa.String(length=36), nullable=False), @@ -110,7 +99,6 @@ def downgrade() -> None: """Downgrade schema.""" # ### commands auto generated by Alembic - please adjust! ### op.drop_table('group_members') - op.drop_table('gek_bundles') op.drop_index('ix_refresh_tokens_hash', table_name='refresh_tokens') op.drop_table('refresh_tokens') op.drop_index('ix_nodes_user_id', table_name='nodes') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py index c420661..cdebd3c 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/models.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py @@ -6,7 +6,6 @@ Tables: nodes — node announcements groups — group registry group_members — group membership - gek_bundles — encrypted GEK per (group, user) refresh_tokens — hashed refresh tokens ip_logs — connection log for legal compliance (1-year retention) """ @@ -45,15 +44,14 @@ class User(Base): pw_version: Mapped[int] = mapped_column(Integer, default=1) pk_ed25519: Mapped[str] = mapped_column(String(64), nullable=False) # base64 raw 32B pk_x25519: Mapped[str] = mapped_column(String(64), nullable=False) # base64 raw 32B + pk_node_ed25519: Mapped[str | None] = mapped_column(String(64), nullable=True) # node daemon key hub_id: Mapped[str] = mapped_column(String(128), nullable=False) - keypair_bundle: Mapped[str | None] = mapped_column(Text) # AES-GCM encrypted, web clients only role: Mapped[str] = mapped_column(String(16), default="user") # user|moderator|admin status: Mapped[str] = mapped_column(String(16), default="active") # active|suspended|revoked created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) nodes: Mapped[list["Node"]] = relationship(back_populates="user") group_memberships: Mapped[list["GroupMember"]] = relationship(back_populates="user") - gek_bundles: Mapped[list["GEKBundle"]] = relationship(back_populates="user") refresh_tokens: Mapped[list["RefreshToken"]] = relationship(back_populates="user") ip_logs: Mapped[list["IPLog"]] = relationship(back_populates="user") @@ -89,11 +87,11 @@ class Group(Base): admin_id: Mapped[str] = mapped_column(ForeignKey("users.id"), nullable=False) visibility: Mapped[str] = mapped_column(String(16), default="private") # public|private join_policy: Mapped[str] = mapped_column(String(16), default="invite") # open|request|invite - status: Mapped[str] = mapped_column(String(16), default="active") # active|revoked + description: Mapped[str | None] = mapped_column(String(512)) + status: Mapped[str] = mapped_column(String(16), default="active") # active|suspended|revoked created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) members: Mapped[list["GroupMember"]] = relationship(back_populates="group") - gek_bundles: Mapped[list["GEKBundle"]] = relationship(back_populates="group") __table_args__ = (Index("ix_groups_name", "name"),) @@ -109,23 +107,6 @@ class GroupMember(Base): user: Mapped["User"] = relationship(back_populates="group_memberships") -# ── GEK bundles ─────────────────────────────────────────────────────────────── - -class GEKBundle(Base): - """Encrypted GEK bundle — opaque to the hub (hub cannot decrypt it).""" - __tablename__ = "gek_bundles" - - group_id: Mapped[str] = mapped_column(ForeignKey("groups.id"), primary_key=True) - user_id: Mapped[str] = mapped_column(ForeignKey("users.id"), primary_key=True) - pk_eph_b64: Mapped[str] = mapped_column(String(64), nullable=False) - nonce_b64: Mapped[str] = mapped_column(String(32), nullable=False) - wrapped_b64: Mapped[str] = mapped_column(String(128), nullable=False) - stored_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) - - group: Mapped["Group"] = relationship(back_populates="gek_bundles") - user: Mapped["User"] = relationship(back_populates="gek_bundles") - - # ── Refresh tokens ──────────────────────────────────────────────────────────── class RefreshToken(Base): diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js index d8f9df5..ddff928 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/app.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js @@ -66,6 +66,58 @@ async function getAllCachedIndexes() { // ── Auth persistence ───────────────────────────────────────────────────────── let _sessionKeys = null; +let _bundleKey = null; +let _pendingBundlePush = null; + +function _openKeyDB() { + return new Promise((resolve, reject) => { + const req = indexedDB.open('meshbay_keys', 1); + req.onupgradeneeded = () => req.result.createObjectStore('k'); + req.onsuccess = () => resolve(req.result); + req.onerror = () => reject(req.error); + }); +} +async function _storeBundleKey(key) { + try { + const db = await _openKeyDB(); + const tx = db.transaction('k', 'readwrite'); + tx.objectStore('k').put(key, 'bk'); + await new Promise(r => { tx.oncomplete = r; }); + db.close(); + } catch {} +} +async function _loadBundleKey() { + try { + const db = await _openKeyDB(); + const tx = db.transaction('k', 'readonly'); + const g = tx.objectStore('k').get('bk'); + const val = await new Promise(r => { g.onsuccess = () => r(g.result); }); + db.close(); + return val || null; + } catch { return null; } +} +async function _clearKeyDB() { + try { + const db = await _openKeyDB(); + const tx = db.transaction('k', 'readwrite'); + tx.objectStore('k').clear(); + await new Promise(r => { tx.oncomplete = r; }); + db.close(); + } catch {} +} +function _saveSessionKeys() { + try { + if (_sessionKeys) sessionStorage.setItem('meshbay_sk', JSON.stringify(_sessionKeys)); + } catch {} +} +function _restoreSessionKeys() { + try { + if (!_sessionKeys) { + const sk = sessionStorage.getItem('meshbay_sk'); + if (sk) _sessionKeys = JSON.parse(sk); + } + } catch {} +} function loadAuth() { try { @@ -81,6 +133,10 @@ function saveAuth(auth) { } else { localStorage.removeItem(AUTH_KEY); _sessionKeys = null; + _bundleKey = null; + _pendingBundlePush = null; + _clearKeyDB(); + try { sessionStorage.removeItem('meshbay_sk'); } catch {} } } @@ -139,9 +195,74 @@ function navigate(path) { const AuthContext = createContext(null); function useAuth() { return useContext(AuthContext); } +// ── User Menu ──────────────────────────────────────────────────────────────── + +function UserMenu({ user, theme, onThemeChange, onLogout }) { + const [open, setOpen] = useState(false); + const [langOpen, setLangOpen] = useState(false); + const ref = useRef(null); + + useEffect(() => { + if (!open) return; + const close = (e) => { + if (ref.current && !ref.current.contains(e.target)) setOpen(false); + }; + document.addEventListener('click', close); + return () => document.removeEventListener('click', close); + }, [open]); + + const resolved = resolveTheme(theme); + + return html` + <div class="user-menu-wrap" ref=${ref}> + <button class="user-menu-trigger" onClick=${() => setOpen(o => !o)}> + <span class="user-menu-avatar">${user.username[0].toUpperCase()}</span> + <span class="user-menu-name">${user.username}</span> + <span class="user-menu-caret">${open ? '▴' : '▾'}</span> + </button> + ${open && html` + <div class="user-menu-dropdown"> + <div class="user-menu-header"> + <span class="user-menu-avatar lg">${user.username[0].toUpperCase()}</span> + <div> + <div class="user-menu-uname">${user.username}</div> + <div class="user-menu-role">${user.role || 'user'}</div> + </div> + </div> + <div class="user-menu-divider"></div> + <button class="user-menu-item" onClick=${(e) => { e.stopPropagation(); setLangOpen(o => !o); }}> + <span class="umi-icon">${'\u{1F310}'}</span> ${t('usermenu.language')} + <span class="umi-arrow">${langOpen ? '▴' : '▾'}</span> + </button> + ${langOpen && LOCALES.map(l => html` + <button key=${l.code} class="user-menu-item user-menu-sub" + onClick=${() => { setLocale(l.code); window.location.reload(); }}> + <span class="umi-icon">${l.flag}</span> ${l.name} + ${getLocale() === l.code && html`<span class="umi-check">${'✓'}</span>`} + </button> + `)} + <button class="user-menu-item" onClick=${() => { setOpen(false); navigate('/settings'); }}> + <span class="umi-icon">${'⚙'}</span> ${t('usermenu.settings')} + </button> + <button class="user-menu-item" onClick=${() => { + onThemeChange(resolved === 'dark' ? 'light' : 'dark'); + }}> + <span class="umi-icon">${resolved === 'dark' ? '☀' : '☾'}</span> + ${' '}${resolved === 'dark' ? t('usermenu.theme_light') : t('usermenu.theme_dark')} + </button> + <div class="user-menu-divider"></div> + <button class="user-menu-item user-menu-logout" onClick=${onLogout}> + <span class="umi-icon">${'⏻'}</span> ${t('usermenu.logout')} + </button> + </div> + `} + </div> + `; +} + // ── Nav ────────────────────────────────────────────────────────────────────── -function Nav({ user, theme, onThemeToggle, onLogout, onMenuToggle, unreadCount }) { +function Nav({ user, theme, onThemeChange, onLogout, onMenuToggle, unreadCount }) { return html` <nav class="nav"> <div class="nav-left"> @@ -157,13 +278,9 @@ function Nav({ user, theme, onThemeToggle, onLogout, onMenuToggle, unreadCount } ${'\u{1F514}'}${unreadCount > 0 && html`<span class="notif-badge">${unreadCount}</span>`} </a> `} - <button class="nav-theme" onClick=${onThemeToggle} - aria-label="${t('nav.toggle_menu')}" title=${theme === 'dark' ? t('nav.light_mode') : t('nav.dark_mode')}> - ${theme === 'dark' ? '☀' : '☾'} - </button> ${user ? html` - <span class="nav-user">${user.username}</span> - <button class="nav-btn" onClick=${onLogout}>${t('nav.logout')}</button> + <${UserMenu} user=${user} theme=${theme} + onThemeChange=${onThemeChange} onLogout=${onLogout} /> ` : html` <a class="nav-btn" href="#/login">${t('nav.login')}</a> `} @@ -178,6 +295,22 @@ function Sidebar({ groups, route, menuOpen, role }) { const isStaff = role === 'moderator' || role === 'admin'; return html` <aside class="sidebar ${menuOpen ? 'open' : ''}"> + ${isStaff && html` + <div class="sidebar-section"> + <div class="sidebar-heading">${t('sidebar.admin')}</div> + <a class="sidebar-item ${route === '/admin' ? 'active' : ''}" + href="#/admin">${'\u{1F6E1}'} ${t('admin.title')}</a> + </div> + `} + <div class="sidebar-section"> + <div class="sidebar-heading">${t('sidebar.discover')}</div> + <a class="sidebar-item ${route === '/explore' ? 'active' : ''}" + href="#/explore">${t('sidebar.public_groups')}</a> + <a class="sidebar-item ${route === '/search' ? 'active' : ''}" + href="#/search">${t('sidebar.search')}</a> + <a class="sidebar-item ${route === '/create-group' ? 'active' : ''}" + href="#/create-group">${t('sidebar.create_group')}</a> + </div> <div class="sidebar-section"> <div class="sidebar-heading">${t('sidebar.my_groups')}</div> ${groups.length === 0 @@ -191,21 +324,6 @@ function Sidebar({ groups, route, menuOpen, role }) { `) } </div> - <div class="sidebar-section"> - <div class="sidebar-heading">${t('sidebar.discover')}</div> - <a class="sidebar-item ${route === '/explore' ? 'active' : ''}" - href="#/explore">${t('sidebar.public_groups')}</a> - <a class="sidebar-item ${route === '/search' ? 'active' : ''}" - href="#/search">${t('sidebar.search')}</a> - <a class="sidebar-item ${route === '/create-group' ? 'active' : ''}" - href="#/create-group">${t('sidebar.create_group')}</a> - <a class="sidebar-item ${route === '/settings' ? 'active' : ''}" - href="#/settings">${t('sidebar.settings')}</a> - ${isStaff && html` - <a class="sidebar-item ${route === '/admin' ? 'active' : ''}" - href="#/admin">${t('sidebar.admin')}</a> - `} - </div> </aside> `; } @@ -455,6 +573,7 @@ function ExplorePage({ token, myGroupIds }) { <div key=${g.id} class="group-card"> <a href="#/group/${g.id}" style="text-decoration:none;color:inherit"> <h3>${g.name}</h3> + ${g.description && html`<p class="group-card-desc">${g.description}</p>`} </a> <span class="badge">${g.join_policy}</span> ${g.source && g.source !== 'local' && html` @@ -484,6 +603,7 @@ function ExplorePage({ token, myGroupIds }) { function CreateGroupPage({ token, onCreated }) { const [name, setName] = useState(''); + const [description, setDescription] = useState(''); const [visibility, setVisibility] = useState('private'); const [joinPolicy, setJoinPolicy] = useState('invite'); const [error, setError] = useState(''); @@ -495,26 +615,12 @@ function CreateGroupPage({ token, onCreated }) { setLoading(true); setError(''); try { + const body = { name: name.trim(), visibility, join_policy: joinPolicy }; + if (description.trim()) body.description = description.trim().slice(0, 512); const data = await hubFetch('/v1/groups', { - method: 'POST', token, - body: { name: name.trim(), visibility, join_policy: joinPolicy }, + method: 'POST', token, body, }); - if (window.MeshBayCrypto) { - try { - const gek = window.MeshBayCrypto.generateGEK(); - const meResp = await hubFetch('/v1/users/me', { token }); - const pubkeys = await hubFetch(`/v1/users/${meResp.username}/pubkeys`); - const pkXBytes = Uint8Array.from(atob(pubkeys.pk_x25519), c => c.charCodeAt(0)); - const bundle = await window.MeshBayCrypto.wrapGEK(gek, pkXBytes); - await hubFetch(`/v1/groups/${data.group_id}/members/${meResp.username}/gek`, { - method: 'POST', token, body: bundle, - }); - } catch (e) { - console.warn('GEK wrap skipped:', e); - } - } - if (onCreated) onCreated(); navigate('/'); } catch (err) { @@ -525,31 +631,70 @@ function CreateGroupPage({ token, onCreated }) { }; return html` - <div class="page-center"> - <h2>${t('create_group.title')}</h2> - <p class="page-message" style="max-width:380px;text-align:center;margin-bottom:12px"> - ${t('create_group.hint')} - </p> - ${error && html`<p class="error-msg">${error}</p>`} - <form class="login-form" onSubmit=${onSubmit}> - <input type="text" placeholder="${t('create_group.name')}" - value=${name} onInput=${e => setName(e.target.value)} required /> - <label class="settings-label">${t('create_group.visibility')}</label> - <select class="settings-select" value=${visibility} - onChange=${e => setVisibility(e.target.value)}> - <option value="private">${t('create_group.private')}</option> - <option value="public">${t('create_group.public')}</option> - </select> - <label class="settings-label">${t('create_group.join_policy')}</label> - <select class="settings-select" value=${joinPolicy} - onChange=${e => setJoinPolicy(e.target.value)}> - <option value="invite">${t('create_group.invite')}</option> - <option value="open">${t('create_group.open')}</option> - </select> - <button type="submit" disabled=${loading}> - ${loading ? t('create_group.creating') : t('create_group.submit')} - </button> - </form> + <div class="create-group-page"> + <div class="create-group-card"> + <div class="create-group-header"> + <h2>${t('create_group.title')}</h2> + <p class="create-group-hint">${t('create_group.hint')}</p> + </div> + ${error && html`<div class="error-msg" style="margin-bottom:16px">${error}</div>`} + <form onSubmit=${onSubmit}> + <div class="form-field"> + <label class="form-label">${t('create_group.name')}</label> + <input type="text" placeholder="e.g. Family Photos, Project Files..." + value=${name} onInput=${e => setName(e.target.value)} required autofocus /> + </div> + + <div class="form-field"> + <label class="form-label">${t('create_group.description')}</label> + <textarea class="form-textarea" rows="3" maxlength="512" + placeholder="${t('create_group.description_hint')}" + value=${description} + onInput=${e => setDescription(e.target.value)} /> + <div class="form-char-count">${description.length}/512</div> + </div> + + <div class="form-field"> + <label class="form-label">${t('create_group.visibility')}</label> + <div class="option-cards"> + <button type="button" class="option-card ${visibility === 'private' ? 'selected' : ''}" + onClick=${() => setVisibility('private')}> + <span class="option-icon">🔒</span> + <span class="option-title">${t('create_group.private')}</span> + <span class="option-desc">Only invited members can see and access files</span> + </button> + <button type="button" class="option-card ${visibility === 'public' ? 'selected' : ''}" + onClick=${() => setVisibility('public')}> + <span class="option-icon">🌐</span> + <span class="option-title">${t('create_group.public')}</span> + <span class="option-desc">Anyone can discover and browse this group</span> + </button> + </div> + </div> + + <div class="form-field"> + <label class="form-label">${t('create_group.join_policy')}</label> + <div class="option-cards"> + <button type="button" class="option-card ${joinPolicy === 'invite' ? 'selected' : ''}" + onClick=${() => setJoinPolicy('invite')}> + <span class="option-icon">✉</span> + <span class="option-title">${t('create_group.invite')}</span> + <span class="option-desc">Members must be invited by an admin</span> + </button> + <button type="button" class="option-card ${joinPolicy === 'open' ? 'selected' : ''}" + onClick=${() => setJoinPolicy('open')}> + <span class="option-icon">🚪</span> + <span class="option-title">${t('create_group.open')}</span> + <span class="option-desc">Anyone can join without approval</span> + </button> + </div> + </div> + + <button class="create-group-submit" type="submit" disabled=${loading}> + ${loading ? t('create_group.creating') : t('create_group.submit')} + </button> + </form> + </div> </div> `; } @@ -617,7 +762,7 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk return results; } -function GroupPage({ groupId, group, token, username }) { +function GroupPage({ groupId, group, token, username, userId }) { const [status, setStatus] = useState('idle'); const [entries, setEntries] = useState([]); const [cached, setCached] = useState(false); @@ -632,10 +777,18 @@ function GroupPage({ groupId, group, token, username }) { const [tab, setTab] = useState('files'); const [uploading, setUploading] = useState(false); const [menuOpen, setMenuOpen] = useState(null); + const [isNodeAdmin, setIsNodeAdmin] = useState(false); const transportRef = useRef(null); const gekRef = useRef(null); useEffect(() => { + if (menuOpen === null) return; + const close = () => setMenuOpen(null); + document.addEventListener('click', close); + return () => document.removeEventListener('click', close); + }, [menuOpen]); + + useEffect(() => { let cancelled = false; getCachedGroupIndex(groupId).then(hit => { @@ -649,6 +802,8 @@ function GroupPage({ groupId, group, token, username }) { setStatus('discovering'); setError(''); gekRef.current = null; + if (!_bundleKey) _bundleKey = await _loadBundleKey(); + _restoreSessionKeys(); try { const nodesData = await hubFetch(`/v1/groups/${groupId}/nodes`, { token }); if (cancelled) return; @@ -657,15 +812,65 @@ function GroupPage({ groupId, group, token, username }) { return; } + // Session keys for P2P GEK bundle fetch (node delivers wrapped GEK) + const sessionKeys = _sessionKeys ? { + skXB64: _sessionKeys.skXB64, + pkXB64: _sessionKeys.pkXB64, + } : null; + setStatus('connecting'); const nodeId = nodesData.nodes[0].node_id; const transport = new window.MeshBayTransport('', token); transportRef.current = transport; - await transport.connect(nodeId, token, groupId); + const ack = await transport.connect( + nodeId, token, groupId, null, sessionKeys, _bundleKey, username); if (cancelled) return; + setIsNodeAdmin(!!ack.is_node_admin); + + // If transport recovered different session keys from node during handshake + if (transport.sessionKeys) { + const recovered = transport.sessionKeys; + if (!_sessionKeys || recovered.skXB64 !== _sessionKeys.skXB64) { + _sessionKeys = recovered; + if (!_sessionKeys.pkXB64) { + const pubkeys = await hubFetch( + `/v1/users/${username}/pubkeys`, { token }); + _sessionKeys.pkXB64 = pubkeys.pk_x25519; + } + _pendingBundlePush = null; + try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {} + _saveSessionKeys(); + } + } + + // Push keypair bundle to node (new registration, localStorage → node) + if (_pendingBundlePush && transport.connected) { + try { + await transport.storeKeypairBundle(_pendingBundlePush); + try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {} + _pendingBundlePush = null; + } catch (e) { + console.warn('[MeshBay] Bundle push to node deferred:', e.message); + } + } + + // Import GEK from transport (fetched from node during handshake) + if (transport.gekRaw && window.MeshBayCrypto) { + gekRef.current = await window.MeshBayCrypto.importGEK( + window.MeshBayCrypto.b64encode(transport.gekRaw)); + } + setStatus('fetching'); + transport.onIndexSync = (msg) => { + if (cancelled) return; + const synced = msg.entries || []; + setEntries(synced); + setCached(false); + cacheGroupIndex(groupId, group ? group.name : groupId, synced); + }; + const indexMsg = await transport.fetchIndex(); if (cancelled) return; const freshEntries = indexMsg.entries || []; @@ -692,6 +897,7 @@ function GroupPage({ groupId, group, token, username }) { return () => { cancelled = true; if (transportRef.current) { + transportRef.current.onIndexSync = null; transportRef.current.close(); transportRef.current = null; } @@ -705,11 +911,6 @@ function GroupPage({ groupId, group, token, username }) { setDlState({ fileId: entry.id, name: entry.name, progress: 0, total: entry.size }); try { - if (!gekRef.current && window.MeshBayCrypto) { - const gekB64 = await transport.fetchGEK(); - gekRef.current = await window.MeshBayCrypto.importGEK(gekB64); - } - const totalChunks = Math.ceil(entry.size / CHUNK_SIZE); let downloaded = 0; const onProgress = (bytes) => { @@ -764,8 +965,9 @@ function GroupPage({ groupId, group, token, username }) { const buf = new Uint8Array(await slice.arrayBuffer()); await transport.uploadChunk(file.name, i, totalChunks, buf); } + await new Promise(r => setTimeout(r, 2500)); const indexMsg = await transport.fetchIndex(); - setEntries(indexMsg.entries || []); + if (indexMsg.entries) setEntries(indexMsg.entries); } catch (err) { setError(err.message); } finally { @@ -777,7 +979,10 @@ function GroupPage({ groupId, group, token, username }) { const transport = transportRef.current; if (!transport || !transport.connected) return; try { - await transport.deleteFile(entry.id); + const signFn = (_sessionKeys && window.MeshBayKeys) + ? (challenge) => window.MeshBayKeys.signChallenge(_sessionKeys.skEdB64, challenge) + : null; + await transport.deleteFile(entry.id, signFn); const indexMsg = await transport.fetchIndex(); setEntries(indexMsg.entries || []); } catch (err) { @@ -846,12 +1051,30 @@ function GroupPage({ groupId, group, token, username }) { return html` <div> <div class="group-header"> - <h2>${group ? group.name : t('group.default_name')}</h2> + <div> + <h2 style="margin-bottom:${group && group.description ? '4px' : '0'}"> + ${group ? group.name : t('group.default_name')} + </h2> + ${group && group.description && html` + <p class="group-desc">${group.description}</p> + `} + </div> <span class="status-badge ${statusClass}"> ${(status === 'discovering' || status === 'connecting' || status === 'fetching') && html`<span class="spinner"></span>${' '}`} ${statusLabel} </span> + ${group && group.is_admin && html` + <button class="admin-btn danger" style="margin-left:auto" + onClick=${async () => { + if (!confirm(t('group.delete_group_confirm', { name: group.name }))) return; + try { + await hubFetch('/v1/groups/' + groupId, { method: 'DELETE', token }); + navigate('/'); + window.location.reload(); + } catch (err) { setError(err.message); } + }}>${t('group.delete_group')}</button> + `} </div> ${error && html`<div class="error-msg" style="margin-bottom:12px">${error}</div>`} ${dlState && html` @@ -954,21 +1177,21 @@ function GroupPage({ groupId, group, token, username }) { setMenuOpen(null); if (e.type === 'video') setVideoEntry(e); else setPreviewEntry(e); - }}>${t('group.view')}</button> + }}><span class="fmi">${'\u{1F441}'}</span> ${t('group.view')}</button> `} <button onClick=${() => { setMenuOpen(null); downloadFile(e); }}> - ${t('group.download')} + <span class="fmi">${'\u{2B07}'}</span> ${t('group.download')} </button> ${e.type === 'video' && html` <button onClick=${() => { setMenuOpen(null); setVideoEntry(e); }}> - ${t('group.play')} + <span class="fmi">${'\u{25B6}'}</span> ${t('group.play')} </button> `} - ${group && group.is_admin && status === 'connected' && html` + ${(isNodeAdmin || (userId && e.uploader_id === userId)) && status === 'connected' && html` <button class="danger" onClick=${() => { setMenuOpen(null); if (confirm(t('group.delete_confirm', { name: e.name }))) deleteFile(e); - }}>${t('group.delete')}</button> + }}><span class="fmi">${'\u{1F5D1}'}</span> ${t('group.delete')}</button> `} </div> `} @@ -987,14 +1210,19 @@ function GroupPage({ groupId, group, token, username }) { ${tab === 'chat' && status === 'connected' && html` <${ChatPanel} transportRef=${transportRef} username=${username} - entries=${entries} gekRef=${gekRef} onRefreshIndex=${refreshIndex} /> + entries=${entries} gekRef=${gekRef} onRefreshIndex=${refreshIndex} + onPreview=${(entry) => { + if (entry.type === 'video') setVideoEntry(entry); + else setPreviewEntry(entry); + }} /> `} ${tab === 'chat' && status !== 'connected' && html` <p class="page-message"><span class="spinner"></span>${' '}${t('status.connecting')}</p> `} ${tab === 'members' && html` - <${MembersPanel} groupId=${groupId} group=${group} token=${token} /> + <${MembersPanel} groupId=${groupId} group=${group} token=${token} + transportRef=${transportRef} gekRef=${gekRef} /> `} `} ${status === 'offline' && html` @@ -1046,10 +1274,6 @@ function FilePreview({ entry, transportRef, gekRef, onClose }) { return; } try { - if (!gekRef.current && window.MeshBayCrypto) { - const gekB64 = await transport.fetchGEK(); - gekRef.current = await window.MeshBayCrypto.importGEK(gekB64); - } const totalChunks = Math.ceil(entry.size / CHUNK_SIZE); let downloaded = 0; const chunks = await pipelinedDownload( @@ -1139,7 +1363,7 @@ function _b64ToU8(b64) { // ── Members Panel ──────────────────────────────────────────────────────── -function MembersPanel({ groupId, group, token }) { +function MembersPanel({ groupId, group, token, transportRef, gekRef }) { const [members, setMembers] = useState([]); const [adminId, setAdminId] = useState(''); const [loading, setLoading] = useState(true); @@ -1168,30 +1392,28 @@ function MembersPanel({ groupId, group, token }) { setInviting(true); setError(''); try { - const pubkeys = await hubFetch(`/v1/users/${inviteUser.trim()}/pubkeys`); + const transport = transportRef && transportRef.current; + const username = inviteUser.trim(); + + // Fetch invitee's public keys (hub = public key directory) + const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token }); const pkXBytes = Uint8Array.from(atob(pubkeys.pk_x25519), c => c.charCodeAt(0)); - const gekB64 = await (async () => { - const transport = window._activeTransport; - if (transport && transport.connected) { - return await transport.fetchGEK(); - } - const bundleResp = await hubFetch(`/v1/groups/${groupId}/gek`, { token }); - if (!_sessionKeys) throw new Error('No session keys — log in via browser registration'); - const skXB64 = _sessionKeys.skXB64; - const skXRaw = Uint8Array.from(atob(skXB64), c => c.charCodeAt(0)); - const meResp = await hubFetch('/v1/users/me', { token }); - const myPubkeys = await hubFetch(`/v1/users/${meResp.username}/pubkeys`); - const myPkX = Uint8Array.from(atob(myPubkeys.pk_x25519), c => c.charCodeAt(0)); - const rawGek = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw, myPkX); - return btoa(String.fromCharCode(...rawGek)); - })(); + // Get raw GEK from the active transport connection + if (!transport || !transport.connected || !transport.gekRaw) { + throw new Error('Not connected to node or no GEK available'); + } + const gekBytes = transport.gekRaw; - const gekBytes = Uint8Array.from(atob(gekB64), c => c.charCodeAt(0)); + // Wrap GEK for invitee and store on node via P2P const bundle = await window.MeshBayCrypto.wrapGEK(gekBytes, pkXBytes); - await hubFetch(`/v1/groups/${groupId}/members/${inviteUser.trim()}/gek`, { - method: 'POST', token, body: bundle, + await transport.storeGekBundle(pubkeys.user_id, groupId, bundle); + + // Add member on hub (membership management only) + await hubFetch(`/v1/groups/${groupId}/members/${username}`, { + method: 'POST', token, body: {}, }); + setInviteUser(''); loadMembers(); } catch (err) { @@ -1263,19 +1485,17 @@ function _parsePayload(raw) { function ChatImage({ filename, entries, transportRef, gekRef }) { const [blobUrl, setBlobUrl] = useState(null); const [loading, setLoading] = useState(true); + const loadedRef = useRef(false); useEffect(() => { + if (loadedRef.current) return; let cancelled = false; const load = async () => { const transport = transportRef.current; - if (!transport || !transport.connected) { setLoading(false); return; } + if (!transport || !transport.connected) { setLoading(true); return; } const entry = entries.find(e => e.name === filename); - if (!entry) { setLoading(false); return; } + if (!entry) { setLoading(true); return; } try { - if (!gekRef.current && window.MeshBayCrypto) { - const gekB64 = await transport.fetchGEK(); - gekRef.current = await window.MeshBayCrypto.importGEK(gekB64); - } const totalChunks = Math.ceil(entry.size / CHUNK_SIZE); const chunks = await pipelinedDownload(transport, gekRef.current, entry.id, totalChunks); if (cancelled) return; @@ -1283,13 +1503,14 @@ function ChatImage({ filename, entries, transportRef, gekRef }) { const mime = ext === 'png' ? 'image/png' : ext === 'gif' ? 'image/gif' : ext === 'webp' ? 'image/webp' : ext === 'svg' ? 'image/svg+xml' : 'image/jpeg'; const blob = new Blob(chunks, { type: mime }); + loadedRef.current = true; setBlobUrl(URL.createObjectURL(blob)); } catch { /* ignore */ } if (!cancelled) setLoading(false); }; load(); return () => { cancelled = true; }; - }, [filename]); + }, [filename, entries.length]); useEffect(() => { return () => { if (blobUrl) URL.revokeObjectURL(blobUrl); }; @@ -1300,7 +1521,7 @@ function ChatImage({ filename, entries, transportRef, gekRef }) { return html`<img class="chat-att-thumb" src=${blobUrl} alt=${filename} />`; } -function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex }) { +function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, onPreview }) { const [messages, setMessages] = useState([]); const [input, setInput] = useState(''); const [sending, setSending] = useState(false); @@ -1377,6 +1598,7 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex }) const buf = new Uint8Array(await slice.arrayBuffer()); await transport.uploadChunk(file.name, i, totalChunks, buf); } + await new Promise(r => setTimeout(r, 2500)); if (onRefreshIndex) await onRefreshIndex(); const ext = file.name.split('.').pop().toLowerCase(); const ftype = ['jpg','jpeg','png','gif','webp','svg'].includes(ext) ? 'image' @@ -1423,7 +1645,11 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex }) `} <div class="chat-bubble ${isOwn ? 'chat-bubble-own' : ''}"> ${att ? html` - <div class="chat-attachment"> + <div class="chat-attachment" style="cursor:pointer" onClick=${() => { + if (!onPreview) return; + const entry = entries.find(e => e.name === att.filename); + if (entry) onPreview(entry); + }}> ${att.type === 'image' ? html`<${ChatImage} filename=${att.filename} entries=${entries} transportRef=${transportRef} gekRef=${gekRef} />` @@ -1522,11 +1748,6 @@ function VideoPlayer({ entry, transportRef, gekRef, onClose }) { }; const startStream = async () => { - if (!gekRef.current && window.MeshBayCrypto) { - const gekB64 = await transport.fetchGEK(); - gekRef.current = await window.MeshBayCrypto.importGEK(gekB64); - } - transport.onStreamInit = (msg) => { if (cancelled) return; const mime = `video/mp4; codecs="${msg.codec}"`; @@ -1744,6 +1965,18 @@ function SettingsPage({ user, theme, onThemeChange, groups }) { try { return JSON.parse(localStorage.getItem('mb_muted') || '{}'); } catch { return {}; } }); + const [nodeKey, setNodeKey] = useState(''); + const [currentNodeKey, setCurrentNodeKey] = useState(null); + const [nodeKeyStatus, setNodeKeyStatus] = useState(''); + const [nodeKeyLoading, setNodeKeyLoading] = useState(false); + + useEffect(() => { + hubFetch(`/v1/users/${user.username}/pubkeys`, { token: user.token }) + .then(data => { + if (data.pk_node_ed25519) setCurrentNodeKey(data.pk_node_ed25519); + }) + .catch(() => {}); + }, [user.username, user.token]); const onLocaleChange = useCallback((e) => { const code = e.target.value; @@ -1764,6 +1997,26 @@ function SettingsPage({ user, theme, onThemeChange, groups }) { }); }, []); + const submitNodeKey = useCallback(async () => { + const key = nodeKey.trim(); + if (!key) return; + setNodeKeyLoading(true); + setNodeKeyStatus(''); + try { + await hubFetch('/v1/users/me/node_key', { + method: 'PUT', token: user.token, + body: { pk_node_ed25519: key }, + }); + setCurrentNodeKey(key); + setNodeKey(''); + setNodeKeyStatus(t('settings.node_key_success')); + } catch (e) { + setNodeKeyStatus(e.message); + } finally { + setNodeKeyLoading(false); + } + }, [nodeKey, user.token]); + return html` <div> <h2>${t('settings.title')}</h2> @@ -1781,6 +2034,32 @@ function SettingsPage({ user, theme, onThemeChange, groups }) { </div> <div class="settings-section"> + <h3 class="settings-heading">${t('settings.node_key')}</h3> + <p style="font-size:0.85em;color:var(--text-dim);margin-bottom:8px">${t('settings.node_key_desc')}</p> + ${currentNodeKey && html` + <div class="settings-row" style="margin-top:8px"> + <span class="settings-label">${t('settings.node_key_current')}</span> + <code class="settings-value" style="font-size:0.8em;word-break:break-all">${currentNodeKey}</code> + </div> + `} + <div style="display:flex;gap:8px;margin-top:10px;align-items:center"> + <input type="text" class="admin-search" style="flex:1;font-family:monospace;font-size:0.85em" + placeholder=${t('settings.node_key_placeholder')} + value=${nodeKey} onInput=${e => setNodeKey(e.target.value)} + onKeyDown=${e => e.key === 'Enter' && submitNodeKey()} /> + <button class="admin-btn" onClick=${submitNodeKey} + disabled=${nodeKeyLoading || !nodeKey.trim()}> + ${t('settings.node_key_submit')} + </button> + </div> + ${nodeKeyStatus && html` + <p style="margin-top:6px;font-size:0.85em;color:${nodeKeyStatus === t('settings.node_key_success') ? 'var(--green, #22c55e)' : 'var(--red, #ef4444)'}"> + ${nodeKeyStatus} + </p> + `} + </div> + + <div class="settings-section"> <h3 class="settings-heading">${t('settings.appearance')}</h3> <div class="settings-row"> <span class="settings-label">${t('settings.theme')}</span> @@ -1987,7 +2266,7 @@ function AdminPage({ token }) { <option value="admin">admin</option> </select> </td> - <td><span class="badge">${u.status}</span></td> + <td><span class="badge ${u.status === 'active' ? 'badge-ok' : u.status === 'suspended' ? 'badge-err' : ''}">${u.status}</span></td> <td>${new Date(u.created_at).toLocaleDateString()}</td> <td class="admin-actions"> <button class="admin-btn" onClick=${() => showUserDetail(u.id)}>${t('admin.btn_details')}</button> @@ -2024,7 +2303,7 @@ function AdminPage({ token }) { <td>${g.name}</td> <td><span class="badge">${g.visibility}</span></td> <td>${g.member_count}</td> - <td><span class="badge">${g.status}</span></td> + <td><span class="badge ${g.status === 'active' ? 'badge-ok' : g.status === 'suspended' ? 'badge-err' : ''}">${g.status}</span></td> <td>${new Date(g.created_at).toLocaleDateString()}</td> <td class="admin-actions"> ${g.status === 'active' @@ -2058,15 +2337,17 @@ function AdminPage({ token }) { <table class="admin-table"> <thead><tr> <th>${t('admin.col_time')}</th> + <th>${t('admin.col_user')}</th> <th>${t('admin.col_event')}</th> <th>${t('admin.col_ip')}</th> <th>${t('admin.col_detail')}</th> </tr></thead> <tbody> - ${logs.length === 0 && html`<tr><td colspan="4" class="admin-empty">${t('admin.no_logs')}</td></tr>`} + ${logs.length === 0 && html`<tr><td colspan="5" class="admin-empty">${t('admin.no_logs')}</td></tr>`} ${logs.map(lg => html` <tr key=${lg.id}> <td style="white-space:nowrap">${new Date(lg.timestamp).toLocaleString()}</td> + <td>${lg.username || ''}</td> <td><span class="badge">${lg.event}</span></td> <td>${lg.ip_address}</td> <td>${lg.detail || ''}</td> @@ -2208,8 +2489,8 @@ function App() { useEffect(() => { setMenuOpen(false); }, [route]); - const toggleTheme = useCallback(() => { - setTheme(prev => resolveTheme(prev) === 'dark' ? 'light' : 'dark'); + const changeTheme = useCallback((val) => { + setTheme(val); }, []); const authCtx = { @@ -2218,9 +2499,14 @@ function App() { let token, refreshToken; if (window.MeshBayKeys) { const data = await window.MeshBayKeys.loginAndRecover(username, password); - _sessionKeys = { skXB64: data.skXB64, skEdB64: data.skEdB64 }; token = data.accessToken; refreshToken = data.refreshToken; + _bundleKey = data.bundleKey; + await _storeBundleKey(_bundleKey); + if (data.skXB64) { + _sessionKeys = { skXB64: data.skXB64, skEdB64: data.skEdB64 }; + _pendingBundlePush = data.keypairBundleEnc; + } } else { const data = await hubFetch('/v1/users/login', { method: 'POST', @@ -2230,7 +2516,12 @@ function App() { refreshToken = data.refresh_token; } const me = await hubFetch('/v1/users/me', { token }); - const u = { username, token, refreshToken, role: me.role }; + if (_sessionKeys) { + const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token }); + _sessionKeys.pkXB64 = pubkeys.pk_x25519; + _saveSessionKeys(); + } + const u = { username, userId: me.user_id, token, refreshToken, role: me.role }; setUser(u); saveAuth(u); }, @@ -2266,7 +2557,7 @@ function App() { const group = groups.find(g => g.id === groupId); page = html`<${GroupPage} groupId=${groupId} group=${group} token=${user.token} - username=${user.username} />`; + username=${user.username} userId=${user.userId} />`; } else if (route === '/admin') { page = (user.role === 'moderator' || user.role === 'admin') ? html`<${AdminPage} token=${user.token} />` @@ -2282,8 +2573,8 @@ function App() { <${AuthContext.Provider} value=${authCtx}> <${Nav} user=${user} - theme=${resolved} - onThemeToggle=${toggleTheme} + theme=${theme} + onThemeChange=${changeTheme} onLogout=${authCtx.logout} onMenuToggle=${() => setMenuOpen(o => !o)} unreadCount=${unreadCount} /> diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js index eb96eef..5ebf624 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js @@ -230,8 +230,24 @@ function b64encode(bytes) { return btoa(String.fromCharCode(...bytes)); } +// ── GEK proof (HMAC-SHA256 for handshake challenge) ───────────────────────── + +async function hmacGEK(gekRaw, nonceB64, offerFp, answerFp) { + const nonce = b64decode(nonceB64); + const data = concatBuffers([ + nonce, + offerFp || new Uint8Array(0), + answerFp || new Uint8Array(0), + ]); + const key = await crypto.subtle.importKey( + 'raw', gekRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']); + const sig = await crypto.subtle.sign('HMAC', key, data); + return b64encode(new Uint8Array(sig)); +} + // Export for use in app.js window.MeshBayCrypto = { importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile, generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode, + hmacGEK, }; diff --git a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js index 2a91407..3450735 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js @@ -89,6 +89,8 @@ const en = { 'group.view': 'View', 'group.delete': 'Delete', 'group.delete_confirm': 'Delete {name}?', + 'group.delete_group': 'Delete group', + 'group.delete_group_confirm': 'Permanently delete "{name}" and remove all members? Files on the node are preserved.', 'group.err_transport': 'Transport module not loaded', // Status @@ -130,12 +132,25 @@ const en = { 'settings.role': 'Role', 'settings.groups': 'Group notifications', 'settings.notifications': 'Notifications', + 'settings.node_key': 'Link Node', + 'settings.node_key_desc': 'If you operate a MeshBay node, paste its Ed25519 public key here to link it to your account. You can find this key in your node\'s admin dashboard.', + 'settings.node_key_placeholder': 'Paste node Ed25519 public key (base64)', + 'settings.node_key_submit': 'Link Node', + 'settings.node_key_success': 'Node linked successfully', + 'settings.node_key_current': 'Linked node key', // Sidebar 'sidebar.create_group': 'Create group', 'sidebar.settings': 'Settings', 'sidebar.admin': 'Admin', + // User menu + 'usermenu.language': 'Language', + 'usermenu.settings': 'Settings', + 'usermenu.theme_light': 'Light mode', + 'usermenu.theme_dark': 'Dark mode', + 'usermenu.logout': 'Logout', + // Admin panel 'admin.title': 'Administration', 'admin.tab_stats': 'Stats', @@ -205,6 +220,8 @@ const en = { 'create_group.join_policy': 'Join policy', 'create_group.invite': 'Invite only', 'create_group.open': 'Open (anyone can join)', + 'create_group.description': 'Description', + 'create_group.description_hint': 'What is this group about? (optional)', 'create_group.submit': 'Create', 'create_group.hint': 'A group needs a node to host files. You can create the group now and connect a node later.', 'create_group.creating': 'Creating...', @@ -245,7 +262,7 @@ const _strings = { en }; let _locale = 'en'; export const LOCALES = [ - { code: 'en', name: 'English' }, + { code: 'en', name: 'English', flag: '\u{1F1EC}\u{1F1E7}' }, ]; export function getLocale() { return _locale; } diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js index 63baff5..ff3da33 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js @@ -23,6 +23,26 @@ const PBKDF2_ITERATIONS = 600000; // OWASP 2023 recommendation for PBKDF2-SHA512 const HUB = ''; // same origin +// ── Auth key derivation (password split) ────────────────────────────────────── + +/** + * Derive an auth key from password + username using PBKDF2-SHA512. + * This key is sent to the hub for authentication — the raw password never leaves the browser. + * Uses a different salt domain than deriveEncryptionKey (bundle key), so the two + * derived values are cryptographically independent. + */ +async function deriveAuthKey(password, username) { + const enc = new TextEncoder(); + const km = await crypto.subtle.importKey( + 'raw', enc.encode(password), 'PBKDF2', false, ['deriveBits']); + const salt = await crypto.subtle.digest( + 'SHA-256', enc.encode(`meshbay:auth:v1:${username}`)); + const bits = await crypto.subtle.deriveBits( + { name: 'PBKDF2', hash: 'SHA-512', salt, iterations: PBKDF2_ITERATIONS }, + km, 256); + return btoa(String.fromCharCode(...new Uint8Array(bits))); +} + // ── Key generation ──────────────────────────────────────────────────────────── /** @@ -105,20 +125,21 @@ async function decryptBundle(bundleB64, password, username) { * Full registration flow: * 1. Generate random keypairs * 2. Encrypt bundle with password - * 3. POST to hub (public keys + encrypted bundle) + * 3. POST to hub (public keys only — no keypair bundle) + * 4. Store encrypted bundle locally for backup to node on first connect * * Returns the raw private keys for immediate use after registration. */ async function registerUser(username, email, password) { const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs(); - // Convert SPKI public keys to raw 32-byte format expected by hub const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']); const pkXCrypto = await crypto.subtle.importKey('spki', pkXRaw, 'X25519', true, []); const pkEdBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto)); const pkXBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto)); const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username); + const authKey = await deriveAuthKey(password, username); const resp = await fetch(`${HUB}/v1/users/register`, { method: 'POST', @@ -126,39 +147,115 @@ async function registerUser(username, email, password) { body: JSON.stringify({ username, email, - password, + auth_key: authKey, pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)), pk_user_x25519: btoa(String.fromCharCode(...pkXBytes)), - keypair_bundle: encBundle, // encrypted, hub stores but cannot read }), }); if (!resp.ok) throw new Error(`Registration failed: ${await resp.text()}`); - return { skEdRaw, skXRaw, pkEdBytes, pkXBytes }; + + // Store encrypted bundle locally — will be backed up to node on first group connect + try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {} + + return { skEdRaw, skXRaw, pkEdBytes, pkXBytes, keypairBundleEnc: encBundle }; +} + +/** + * Decrypt a keypair bundle using a pre-derived AES-256 CryptoKey. + * Used when the bundle is fetched from the node (bundleKey was derived at login). + */ +async function decryptBundleWithKey(bundleB64, aesKey) { + const raw = Uint8Array.from(atob(bundleB64), c => c.charCodeAt(0)); + const nonce = raw.slice(0, 12); + const ct = raw.slice(12); + const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ct); + return JSON.parse(new TextDecoder().decode(plain)); } /** - * Login and recover private keys from the encrypted bundle. + * Login and recover private keys. + * + * If localStorage has a keypair bundle (new registration, not yet pushed to node), + * decrypts it and returns the keys + encrypted bundle for push to node. + * Otherwise returns bundleKey so the caller can fetch from node during handshake. */ async function loginAndRecover(username, password) { + const authKey = await deriveAuthKey(password, username); + const resp = await fetch(`${HUB}/v1/users/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ username, password }), + body: JSON.stringify({ username, auth_key: authKey }), }); + if (!resp.ok) throw new Error(`Login failed: ${await resp.text()}`); const data = await resp.json(); - const bundle = data.keypair_bundle; - if (!bundle) throw new Error('No keypair bundle in response — account may have been created via CLI'); - - const keys = await decryptBundle(bundle, password, username); - return { + const result = { accessToken: data.access_token, refreshToken: data.refresh_token, - skEdB64: keys.skEd, - skXB64: keys.skX, + bundleKey: await deriveEncryptionKey(password, username), }; + + // localStorage bundle = new registration, not yet pushed to node + const bundleEnc = (typeof localStorage !== 'undefined' + && localStorage.getItem(`meshbay_kp_${username}`)) || null; + + if (bundleEnc) { + const keys = await decryptBundle(bundleEnc, password, username); + result.skEdB64 = keys.skEd; + result.skXB64 = keys.skX; + result.keypairBundleEnc = bundleEnc; + } + + return result; +} + +async function regenerateKeys(token, username, password) { + const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs(); + + const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']); + const pkXCrypto = await crypto.subtle.importKey('spki', pkXRaw, 'X25519', true, []); + const pkEdBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto)); + const pkXBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto)); + + const resp = await fetch(`${HUB}/v1/users/me/keys`, { + method: 'PUT', + headers: { + 'Content-Type': 'application/json', + 'Authorization': `Bearer ${token}`, + }, + body: JSON.stringify({ + pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)), + pk_user_x25519: btoa(String.fromCharCode(...pkXBytes)), + }), + }); + + if (!resp.ok) throw new Error(`Key rotation failed: ${await resp.text()}`); + + const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username); + try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {} + + return { + skEdB64: btoa(String.fromCharCode(...new Uint8Array(skEdRaw))), + skXB64: btoa(String.fromCharCode(...new Uint8Array(skXRaw))), + pkEdB64: btoa(String.fromCharCode(...pkEdBytes)), + pkXB64: btoa(String.fromCharCode(...pkXBytes)), + keypairBundleEnc: encBundle, + }; +} + +async function signChallenge(skEdPkcs8B64, challengeB64) { + const skRaw = Uint8Array.from(atob(skEdPkcs8B64), c => c.charCodeAt(0)); + const sk = await crypto.subtle.importKey( + 'pkcs8', skRaw, { name: 'Ed25519' }, false, ['sign']); + const challenge = Uint8Array.from(atob(challengeB64), c => c.charCodeAt(0)); + const sig = await crypto.subtle.sign('Ed25519', sk, challenge); + return btoa(String.fromCharCode(...new Uint8Array(sig))); } -window.MeshBayKeys = { registerUser, loginAndRecover, generateKeypairs }; +window.MeshBayKeys = { + registerUser, loginAndRecover, regenerateKeys, generateKeypairs, signChallenge, + deriveAuthKey, decryptBundleWithKey, +}; diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css index f3dcbf4..e430201 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/style.css +++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css @@ -95,20 +95,81 @@ a:hover { text-decoration: underline; } .nav-user { color: var(--text-dim); font-size: 0.9em; } -.nav-theme { - background: none; - border: 1px solid rgba(255, 255, 255, 0.15); - color: var(--nav-text); - width: 32px; - height: 32px; - border-radius: 6px; - cursor: pointer; - font-size: 1.1em; +/* ── User Menu ──────────────────────────────────────────────────────────── */ + +.user-menu-wrap { position: relative; } + +.user-menu-trigger { display: flex; align-items: center; - justify-content: center; + gap: 8px; + background: rgba(255, 255, 255, 0.08); + border: 1px solid rgba(255, 255, 255, 0.12); + color: var(--nav-text); + padding: 4px 10px 4px 4px; + border-radius: 20px; + cursor: pointer; + font-size: 0.85em; + transition: background 0.12s; +} +.user-menu-trigger:hover { background: rgba(255, 255, 255, 0.15); } + +.user-menu-avatar { + width: 28px; height: 28px; + border-radius: 50%; + background: var(--accent); + color: #fff; + display: flex; align-items: center; justify-content: center; + font-weight: 700; font-size: 0.8em; + flex-shrink: 0; +} +.user-menu-avatar.lg { width: 36px; height: 36px; font-size: 0.95em; } + +.user-menu-name { max-width: 120px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; } +.user-menu-caret { font-size: 0.7em; color: rgba(255,255,255,0.5); } + +.user-menu-dropdown { + position: absolute; + right: 0; top: calc(100% + 6px); + background: var(--bg-surface); + border: 1px solid var(--border); + border-radius: 10px; + box-shadow: var(--shadow-lg); + min-width: 220px; + z-index: 120; + overflow: hidden; + padding: 4px 0; } -.nav-theme:hover { border-color: rgba(255, 255, 255, 0.3); background: none; } + +.user-menu-header { + display: flex; align-items: center; gap: 10px; + padding: 12px 14px 8px; +} +.user-menu-uname { font-weight: 600; font-size: 0.9em; color: var(--text); } +.user-menu-role { font-size: 0.75em; color: var(--text-dim); text-transform: capitalize; } + +.user-menu-divider { height: 1px; background: var(--border); margin: 4px 0; } + +.user-menu-section-label { + padding: 6px 14px 2px; + font-size: 0.7em; text-transform: uppercase; letter-spacing: 0.06em; + color: var(--text-dim); font-weight: 600; +} + +.user-menu-item { + display: flex; align-items: center; gap: 8px; + width: 100%; padding: 8px 14px; + background: none; border: none; border-radius: 0; + color: var(--text); font-size: 0.85em; + cursor: pointer; text-align: left; +} +.user-menu-item:hover { background: var(--bg-raised); } +.user-menu-logout { color: var(--error); } + +.umi-icon { width: 18px; text-align: center; font-size: 0.95em; flex-shrink: 0; } +.umi-arrow { margin-left: auto; font-size: 0.7em; color: var(--text-dim); } +.umi-check { margin-left: auto; color: var(--accent); font-size: 0.85em; } +.user-menu-sub { padding-left: 32px; } .nav-btn { background: rgba(255, 255, 255, 0.1); @@ -289,14 +350,17 @@ button:disabled { opacity: 0.5; cursor: not-allowed; } border-radius: 12px; font-size: 0.75em; } +.badge-ok { background: #16a34a20; color: var(--success); } +.badge-err { background: var(--error-bg); color: var(--error); } /* ── Group page header ───────────────────────────────────────────────────── */ .group-header { display: flex; - align-items: center; + align-items: flex-start; gap: 12px; margin-bottom: 16px; + flex-wrap: wrap; } .group-header h2 { margin-bottom: 0; } @@ -688,8 +752,10 @@ button:disabled { opacity: 0.5; cursor: not-allowed; } } .chat-bubble-own .chat-att-size { color: rgba(255, 255, 255, 0.6); } +.file-menu button { display: flex; align-items: center; gap: 8px; } .file-menu button.danger { color: var(--error); } .file-menu button.danger:hover { background: var(--error-bg); } +.fmi { font-size: 0.9em; width: 16px; text-align: center; flex-shrink: 0; } /* ── Download button + progress ──────────────────────────────────────────── */ @@ -1228,3 +1294,105 @@ button:disabled { opacity: 0.5; cursor: not-allowed; } color: var(--text-secondary); white-space: nowrap; } + +/* ── Create Group page ───────────────────────────────────────────────────── */ + +.create-group-page { + display: flex; + justify-content: center; + padding-top: 8px; +} + +.create-group-card { + width: 100%; + max-width: 520px; + background: var(--bg-surface); + border: 1px solid var(--border); + border-radius: 12px; + padding: 32px; + box-shadow: var(--shadow); +} + +.create-group-header { margin-bottom: 24px; } +.create-group-header h2 { margin-bottom: 8px; font-size: 1.3em; } +.create-group-hint { + color: var(--text-secondary); + font-size: 0.88em; + line-height: 1.5; +} + +.form-field { margin-bottom: 20px; } +.form-label { + display: block; + font-size: 0.82em; + font-weight: 600; + color: var(--text-secondary); + text-transform: uppercase; + letter-spacing: 0.04em; + margin-bottom: 8px; +} + +.option-cards { display: grid; grid-template-columns: 1fr 1fr; gap: 10px; } + +.option-card { + display: flex; flex-direction: column; align-items: center; gap: 4px; + padding: 14px 10px; + background: var(--bg-base); + border: 2px solid var(--border); + border-radius: 10px; + cursor: pointer; + text-align: center; + transition: border-color 0.12s, background 0.12s; +} +.option-card:hover { border-color: var(--accent); background: var(--bg-base); } +.option-card.selected { + border-color: var(--accent); + background: color-mix(in srgb, var(--accent) 8%, var(--bg-base)); +} + +.option-icon { font-size: 1.5em; margin-bottom: 2px; } +.option-title { font-weight: 600; font-size: 0.9em; color: var(--text); } +.option-desc { font-size: 0.75em; color: var(--text-dim); line-height: 1.3; } + +.create-group-submit { + width: 100%; + padding: 12px; + font-size: 1em; + font-weight: 600; + margin-top: 8px; + border-radius: 8px; +} + +.form-textarea { + width: 100%; + padding: 10px 12px; + border: 1px solid var(--border); + border-radius: 6px; + background: var(--bg-base); + color: var(--text); + font-size: 0.95em; + font-family: inherit; + resize: vertical; + min-height: 60px; + line-height: 1.5; +} +.form-textarea:focus { outline: none; border-color: var(--border-focus); } +.form-char-count { text-align: right; font-size: 0.75em; color: var(--text-dim); margin-top: 4px; } + +.group-desc { + font-size: 0.85em; + color: var(--text-secondary); + line-height: 1.4; + margin-bottom: 4px; +} + +.group-card-desc { + font-size: 0.8em; + color: var(--text-dim); + line-height: 1.3; + margin: 4px 0 6px; + display: -webkit-box; + -webkit-line-clamp: 2; + -webkit-box-orient: vertical; + overflow: hidden; +} diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index 1dc1ded..ca9c60e 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -16,6 +16,16 @@ * transport.close(); */ +async function _pkFromSk(skPkcs8B64) { + const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0)); + const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'X25519' }, true, ['deriveBits']); + const jwk = await crypto.subtle.exportKey('jwk', sk); + const b64url = jwk.x; + const b64 = b64url.replace(/-/g, '+').replace(/_/g, '/'); + const pad = b64.length % 4; + return pad ? b64 + '='.repeat(4 - pad) : b64; +} + class MeshBayTransport { constructor(hubUrl, accessToken) { this._hubUrl = hubUrl; @@ -30,6 +40,7 @@ class MeshBayTransport { this._onStreamInit = null; this._onStreamData = null; this._onStreamEnd = null; + this._onIndexSync = null; } get connected() { return this._connected; } @@ -38,8 +49,15 @@ class MeshBayTransport { set onStreamInit(fn) { this._onStreamInit = fn; } set onStreamData(fn) { this._onStreamData = fn; } set onStreamEnd(fn) { this._onStreamEnd = fn; } + set onIndexSync(fn) { this._onIndexSync = fn; } + + get sessionKeys() { return this._sessionKeys; } - async connect(nodeId, jwtToken, groupId) { + async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username) { + this._gekRaw = gekRaw || null; + this._sessionKeys = sessionKeys || null; + this._bundleKey = bundleKey || null; + this._username = username || null; this._pc = new RTCPeerConnection({ iceServers: [{ urls: 'stun:stun.l.google.com:19302' }], }); @@ -106,22 +124,94 @@ class MeshBayTransport { } const answer = await resp.json(); + this._rawAnswerSdp = answer.sdp; await this._pc.setRemoteDescription({ type: 'answer', sdp: answer.sdp }); await channelReady; - const ack = await this._sendAndWait({ + const reply = await this._sendAndWait({ type: 'handshake', v: '0.1', token: jwtToken, group_id: groupId || '', }); - if (ack.type !== 'handshake_ack') { - throw new Error('MNP handshake rejected: ' + (ack.detail || JSON.stringify(ack))); + if (reply.type === 'handshake_challenge') { + if (!window.MeshBayCrypto) { + throw new Error('Node requires GEK proof but no crypto available'); + } + + // Recover session keys from node if not available locally (P2P keypair bundle) + if (!this._sessionKeys && this._bundleKey && window.MeshBayKeys) { + const kpResp = await this._sendAndWait({ + type: 'keypair_bundle_fetch', v: '0.1', + }); + if (kpResp.type === 'keypair_bundle_resp' && kpResp.found) { + const keys = await window.MeshBayKeys.decryptBundleWithKey( + kpResp.bundle_enc, this._bundleKey); + const pkXB64 = await _pkFromSk(keys.skX); + this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 }; + } + } + + // Fetch wrapped GEK bundle from node (P2P only — hub never touches crypto) + if (!gekRaw && this._sessionKeys) { + const bundleResp = await this._sendAndWait({ + type: 'gek_bundle_fetch', v: '0.1', + }); + if (bundleResp.type === 'gek_bundle_resp' && bundleResp.found) { + const skXRaw = Uint8Array.from(atob(this._sessionKeys.skXB64), c => c.charCodeAt(0)); + const myPkX = Uint8Array.from(atob(this._sessionKeys.pkXB64), c => c.charCodeAt(0)); + try { + gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw, myPkX); + this._gekRaw = gekRaw; + } catch (e) { + console.warn('[MeshBay] GEK unwrap failed with local keys, trying node keypair bundle'); + if (this._bundleKey && window.MeshBayKeys) { + const kpResp = await this._sendAndWait({ + type: 'keypair_bundle_fetch', v: '0.1', + }); + if (kpResp.type === 'keypair_bundle_resp' && kpResp.found) { + const keys = await window.MeshBayKeys.decryptBundleWithKey( + kpResp.bundle_enc, this._bundleKey); + const pkXB64 = await _pkFromSk(keys.skX); + this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 }; + const skXRaw2 = Uint8Array.from(atob(keys.skX), c => c.charCodeAt(0)); + const myPkX2 = Uint8Array.from(atob(pkXB64), c => c.charCodeAt(0)); + gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw2, myPkX2); + this._gekRaw = gekRaw; + } + } + } + } + } + + if (!gekRaw) { + throw new Error('Node requires GEK proof but no GEK available'); + } + + let proof = ''; + if (gekRaw) { + const offerFp = _extractDtlsFingerprint(this._pc.localDescription.sdp); + const answerFp = _extractDtlsFingerprint(this._rawAnswerSdp); + proof = await window.MeshBayCrypto.hmacGEK(gekRaw, reply.nonce, offerFp, answerFp); + } + const ack = await this._sendAndWait({ + type: 'handshake_response', + v: '0.1', + proof, + }); + if (ack.type !== 'handshake_ack') { + throw new Error('GEK proof rejected: ' + (ack.detail || JSON.stringify(ack))); + } + return ack; } - return ack; + if (reply.type !== 'handshake_ack') { + throw new Error('MNP handshake rejected: ' + (reply.detail || JSON.stringify(reply))); + } + + return reply; } async fetchIndex() { @@ -130,12 +220,6 @@ class MeshBayTransport { return msg; } - async fetchGEK() { - const msg = await this._sendAndWait({ type: 'gek_req', v: '0.1' }); - if (msg.type === 'error') throw new Error(msg.detail); - return msg.gek_b64; - } - async fetchChunk(fileId, chunkIndex) { const msg = await this._sendAndWait({ type: 'file_req', @@ -182,13 +266,25 @@ class MeshBayTransport { return msg; } - async deleteFile(fileId) { + async deleteFile(fileId, signFn) { const msg = await this._sendAndWait({ type: 'file_delete', v: '0.1', file_id: fileId, }); if (msg.type === 'error') throw new Error(msg.detail); + if (msg.type === 'admin_challenge') { + if (!signFn) throw new Error('Admin challenge received but no signing key available'); + const signature = await signFn(msg.challenge); + const ack = await this._sendAndWait({ + type: 'admin_response', + v: '0.1', + file_id: fileId, + signature, + }); + if (ack.type === 'error') throw new Error(ack.detail); + return ack; + } return msg; } @@ -208,6 +304,32 @@ class MeshBayTransport { return msg; } + async storeGekBundle(userId, groupId, bundle) { + const msg = await this._sendAndWait({ + type: 'gek_bundle_store', + v: '0.1', + user_id: userId, + group_id: groupId, + pk_eph_b64: bundle.pk_eph_b64, + nonce_b64: bundle.nonce_b64, + wrapped_b64: bundle.wrapped_b64, + }); + if (msg.type === 'error') throw new Error(msg.detail); + return msg; + } + + async storeKeypairBundle(bundleEnc) { + const msg = await this._sendAndWait({ + type: 'keypair_bundle_store', + v: '0.1', + bundle_enc: bundleEnc, + }); + if (msg.type === 'error') throw new Error(msg.detail); + return msg; + } + + get gekRaw() { return this._gekRaw; } + close() { if (this._channel) this._channel.close(); if (this._pc) this._pc.close(); @@ -226,6 +348,7 @@ class MeshBayTransport { reject(new Error('Response timeout')); }, 30000); this._pending.set(id, { + _reqType: obj.type, resolve: (msg) => { clearTimeout(timeout); this._pending.delete(id); resolve(msg); }, reject: (err) => { clearTimeout(timeout); this._pending.delete(id); reject(err); }, }); @@ -269,16 +392,25 @@ class MeshBayTransport { this._onChat(msg); return; } - if (msg.type === 'stream_init' && this._onStreamInit) { - this._onStreamInit(msg); + if (msg.type === 'stream_init') { + if (this._onStreamInit) this._onStreamInit(msg); + return; + } + if (msg.type === 'stream_data') { + if (this._onStreamData) this._onStreamData(msg); return; } - if (msg.type === 'stream_data' && this._onStreamData) { - this._onStreamData(msg); + if (msg.type === 'stream_end') { + if (this._onStreamEnd) this._onStreamEnd(msg); return; } - if (msg.type === 'stream_end' && this._onStreamEnd) { - this._onStreamEnd(msg); + + if (msg.type === 'index_sync' && msg.entries) { + if (this._onIndexSync) this._onIndexSync(msg); + const oldest = this._pending.entries().next(); + if (!oldest.done && oldest.value[1]._reqType === 'index_sync') { + oldest.value[1].resolve(msg); + } return; } @@ -485,5 +617,15 @@ function _b64decode(b64) { return bytes; } +function _extractDtlsFingerprint(sdp) { + const match = sdp.match(/a=fingerprint:sha-256 ([0-9A-Fa-f:]+)/); + if (!match) return new Uint8Array(0); + const hex = match[1].replace(/:/g, ''); + const bytes = new Uint8Array(hex.length / 2); + for (let i = 0; i < hex.length; i += 2) + bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16); + return bytes; +} + // Export window.MeshBayTransport = MeshBayTransport; |