Refactor chat encryption to use sodium, update API

Replaces legacy chat encryption modules with new sodium-based implementation. Adds and updates API routes for chat key management and debugging, introduces new hooks and scripts for sodium chat, and updates related database schema and configuration. Removes old crypto modules and updates dependencies accordingly.

src/app/api/chat/keys/route.ts

@@ -1,79 +1,120 @@
-
 import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/db';
-import { chatDeviceBundles, chatOneTimeKeys } from '@/db/schema';
-import { requireSignedAction } from '@/lib/auth/verify-signature';
+import { chatDeviceBundles } from '@/db/schema';
+import { requireAuth } from '@/lib/auth';
 import { eq, and } from 'drizzle-orm';
 
+/**
+ * GET /api/chat/keys?did=<did>
+ * Fetch public key for a user
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const did = searchParams.get('did');
+
+    if (!did) {
+      return NextResponse.json({ error: 'Missing did parameter' }, { status: 400 });
+    }
+
+    console.log('[Chat Keys GET] Looking for DID:', did);
+
+    const bundle = await db.query.chatDeviceBundles.findFirst({
+      where: eq(chatDeviceBundles.did, did),
+    });
+
+    console.log('[Chat Keys GET] Found bundle:', bundle ? 'YES' : 'NO');
+    if (bundle) {
+      console.log('[Chat Keys GET] Bundle data:', {
+        userId: bundle.userId,
+        did: bundle.did,
+        deviceId: bundle.deviceId,
+        hasIdentityKey: !!bundle.identityKey,
+      });
+    }
+
+    if (!bundle) {
+      return NextResponse.json({ error: 'No keys found' }, { status: 404 });
+    }
+
+    // For libsodium, we just need the public key
+    return NextResponse.json({
+      publicKey: bundle.identityKey, // Reusing identityKey field for libsodium public key
+    });
+  } catch (error: any) {
+    console.error('[Chat Keys] Failed to fetch keys:', error);
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+}
+
 /**
  * POST /api/chat/keys
- * Publish a new Device Bundle and OTKs.
+ * Publish public key
  * 
- * Payload: SignedAction < { 
- *   deviceId: string, 
- *   identityKey: string,
- *   signedPreKey: { id, key, sig },
- *   signature: string, (The ECDSA signature of the bundle itself)
- *   oneTimeKeys: { id, key }[]
- * } >
+ * Body: {
+ *   publicKey: string (base64)
+ * }
  */
 export async function POST(request: NextRequest) {
   try {
+    const user = await requireAuth();
+    
+    console.log('[Chat Keys POST] User:', user.handle, 'DID:', user.did, 'UserID:', user.id);
+
     const body = await request.json();
+    const { publicKey } = body;
 
-    // 1. Verify User Identity (ECDSA Root)
-    // The wrapper itself is a SignedAction with action="chat.keys.publish"
-    // This proves the user (DID) is authorizing this device registration.
-    const user = await requireSignedAction(body);
+    console.log('[Chat Keys POST] Received publicKey:', publicKey ? publicKey.substring(0, 20) + '...' : 'MISSING');
 
-    const { deviceId, identityKey, signedPreKey, signature, oneTimeKeys } = body.data;
+    if (!publicKey) {
+      return NextResponse.json({ error: 'Missing publicKey' }, { status: 400 });
+    }
 
-    // 2. Validate Bundle Signature (The bundle.signature must cover the fields)
-    // Actually, requireSignedAction already verified the payload signature.
-    // The "signature" field inside data is redundant if the whole thing is signed by DID?
-    // Or is "signature" the signature of the bundle bytes? 
-    // In our design, the SignedAction *is* the signature.
-    // So "signature" inside might be the "Self-Signature" of the X25519 Identity Key signing the structure?
-    // No, standard Signal: The Bundle is signed by Identity Key.
-    // Here, Identity Key is ECDSA. The SignedAction covers it.
-    // So we just trust the SignedAction.
-
-    // 3. Upsert Bundle
-    await db.transaction(async (tx) => {
-      // Upsert device bundle
-      await tx.delete(chatDeviceBundles).where(
-        and(
-          eq(chatDeviceBundles.userId, user.id),
-          eq(chatDeviceBundles.deviceId, deviceId)
-        )
-      );
-
-      const [bundle] = await tx.insert(chatDeviceBundles).values({
-        userId: user.id,
-        did: user.did,
-        deviceId,
-        identityKey,
-        signedPreKey: JSON.stringify(signedPreKey),
-        signature, // We store the action signature or the explicit inner signature provided
-      }).returning();
-
-      // 4. Insert OTKs
-      if (oneTimeKeys && oneTimeKeys.length > 0) {
-        await tx.insert(chatOneTimeKeys).values(
-          oneTimeKeys.map((k: any) => ({
-            userId: user.id,
-            bundleId: bundle.id,
-            keyId: k.id,
-            publicKey: k.key
-          }))
-        ).onConflictDoNothing();
-      }
+    // Check if bundle exists
+    const existing = await db.query.chatDeviceBundles.findFirst({
+      where: and(
+        eq(chatDeviceBundles.userId, user.id),
+        eq(chatDeviceBundles.deviceId, '1')
+      )
     });
 
-    return NextResponse.json({ success: true, count: oneTimeKeys?.length || 0 });
+    console.log('[Chat Keys POST] Existing bundle found:', existing ? 'YES' : 'NO');
 
+    if (existing) {
+      // Update existing bundle
+      console.log('[Chat Keys POST] Updating existing bundle...');
+      await db.update(chatDeviceBundles)
+        .set({
+          identityKey: publicKey,
+          did: user.did, // Update DID too in case it changed
+          lastSeenAt: new Date(),
+        })
+        .where(
+          and(
+            eq(chatDeviceBundles.userId, user.id),
+            eq(chatDeviceBundles.deviceId, '1')
+          )
+        );
+      console.log('[Chat Keys POST] Updated existing key');
+    } else {
+      // Insert new bundle
+      console.log('[Chat Keys POST] Inserting new bundle...');
+      await db.insert(chatDeviceBundles).values({
+        userId: user.id,
+        did: user.did,
+        deviceId: '1',
+        identityKey: publicKey,
+        signedPreKey: 'libsodium', // Placeholder
+        registrationId: 1,
+        signature: 'libsodium',
+      });
+      console.log('[Chat Keys POST] Inserted new key');
+    }
+
+    console.log('[Chat Keys POST] Key published successfully for', user.handle);
+    return NextResponse.json({ success: true });
   } catch (error: any) {
-    console.error('Failed to publish keys:', error);
-    return NextResponse.json({ error: error.message }, { status: 400 });
+    console.error('[Chat Keys] Failed to publish key:', error);
+    return NextResponse.json({ error: error.message }, { status: 500 });
   }
-}
+}

src/app/api/chat/send/route.ts

@@ -1,212 +1,116 @@
-
 import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/db';
-import { chatInbox, chatConversations, chatMessages, users } from '@/db/schema';
-import { requireSignedAction } from '@/lib/auth/verify-signature';
+import { chatConversations, chatMessages, users } from '@/db/schema';
+import { requireAuth } from '@/lib/auth';
 import { eq, and } from 'drizzle-orm';
-import { signedFetch } from '@/lib/api/signed-fetch';
 
 /**
  * POST /api/chat/send
- * Deliver an encrypted envelope to a local or remote user's inbox.
+ * Store encrypted message (server never decrypts)
+ * 
+ * Body: {
+ *   recipientDid: string,
+ *   senderPublicKey: string (base64),
+ *   ciphertext: string (base64),
+ *   nonce: string (base64),
+ *   recipientHandle?: string
+ * }
  */
 export async function POST(request: NextRequest) {
     try {
+        const user = await requireAuth();
+
         const body = await request.json();
+        const { recipientDid, senderPublicKey, ciphertext, nonce, recipientHandle } = body;
 
-        // 1. Verify Envelope Signature (Anti-Spoofing & Replay)
-        const user = await requireSignedAction(body);
-
-        const { action, data } = body;
-        if (action !== 'chat.deliver') {
-            return NextResponse.json({ error: 'Invalid action type' }, { status: 400 });
+        if (!recipientDid || !senderPublicKey || !ciphertext || !nonce) {
+            return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
         }
 
-        const { recipientDid, recipientDeviceId, ciphertext, nodeDomain, recipientHandle } = data;
-
-        if (!recipientDid || !ciphertext) {
-            return NextResponse.json({ error: 'Missing required delivery fields' }, { status: 400 });
-        }
-
-        // 2. Check if recipient is local or remote
+        // Check if recipient is local
         const recipientUser = await db.query.users.findFirst({
             where: eq(users.did, recipientDid)
         });
 
         if (recipientUser) {
-            // LOCAL RECIPIENT - Store in local inbox
+            // LOCAL RECIPIENT
             
-            // Ensure conversation exists for recipient
-            let conversation = await db.query.chatConversations.findFirst({
+            // Ensure conversations exist
+            let recipientConv = await db.query.chatConversations.findFirst({
                 where: and(
                     eq(chatConversations.participant1Id, recipientUser.id),
                     eq(chatConversations.participant2Handle, user.handle)
                 )
             });
 
-            if (!conversation) {
+            if (!recipientConv) {
                 const [newConv] = await db.insert(chatConversations).values({
                     participant1Id: recipientUser.id,
                     participant2Handle: user.handle,
                     lastMessageAt: new Date(),
-                    lastMessagePreview: '[Encrypted Message]'
+                    lastMessagePreview: '[Encrypted]'
                 }).returning();
-                conversation = newConv;
+                recipientConv = newConv;
             }
 
-            // Ensure conversation exists for sender
-            let senderConversation = await db.query.chatConversations.findFirst({
+            let senderConv = await db.query.chatConversations.findFirst({
                 where: and(
                     eq(chatConversations.participant1Id, user.id),
                     eq(chatConversations.participant2Handle, recipientUser.handle)
                 )
             });
 
-            if (!senderConversation) {
-                await db.insert(chatConversations).values({
+            if (!senderConv) {
+                const [newConv] = await db.insert(chatConversations).values({
                     participant1Id: user.id,
                     participant2Handle: recipientUser.handle,
                     lastMessageAt: new Date(),
-                    lastMessagePreview: '[Encrypted Message]'
-                });
+                    lastMessagePreview: '[Encrypted]'
+                }).returning();
+                senderConv = newConv;
             }
 
-            // Insert into local inbox
-            await db.insert(chatInbox).values({
+            // Store encrypted message (libsodium format)
+            // Include recipientDid so sender can decrypt their own sent messages
+            const messageData = {
+                senderPublicKey,
+                recipientDid, // Add this so sender knows who to decrypt with
+                ciphertext,
+                nonce,
+            };
+
+            // Create message for recipient
+            await db.insert(chatMessages).values({
+                conversationId: recipientConv.id,
+                senderHandle: user.handle,
+                senderDisplayName: user.displayName,
+                senderAvatarUrl: user.avatarUrl,
+                senderNodeDomain: null,
                 senderDid: user.did,
-                recipientDid,
-                recipientDeviceId: recipientDeviceId || null,
-                envelope: JSON.stringify(body),
-                expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
+                encryptedContent: JSON.stringify(messageData),
+                deliveredAt: new Date(),
             });
 
-            return NextResponse.json({ success: true, local: true });
+            // Create message for sender
+            await db.insert(chatMessages).values({
+                conversationId: senderConv.id,
+                senderHandle: user.handle,
+                senderDisplayName: user.displayName,
+                senderAvatarUrl: user.avatarUrl,
+                senderNodeDomain: null,
+                senderDid: user.did,
+                encryptedContent: JSON.stringify(messageData),
+                deliveredAt: new Date(),
+            });
 
+            return NextResponse.json({ success: true });
         } else {
-            // REMOTE RECIPIENT - Forward to their node
-            
-            let targetNodeDomain = nodeDomain;
-            
-            if (!targetNodeDomain) {
-                // Try to extract from DID
-                if (recipientDid.startsWith('did:web:')) {
-                    targetNodeDomain = recipientDid.replace('did:web:', '');
-                } else {
-                    return NextResponse.json({ 
-                        error: 'Remote delivery requires node domain' 
-                    }, { status: 400 });
-                }
-            }
-
-            // Forward the signed envelope to the remote node
-            const remoteUrl = `https://${targetNodeDomain}/api/swarm/chat/inbox`;
-            
-            try {
-                console.log('[Chat Send] Forwarding to remote:', remoteUrl);
-                
-                // Get or create conversation for sender
-                let conversation = await db.query.chatConversations.findFirst({
-                    where: and(
-                        eq(chatConversations.participant1Id, user.id),
-                        eq(chatConversations.participant2Handle, recipientHandle || recipientDid)
-                    )
-                });
-
-                if (!conversation) {
-                    const [newConv] = await db.insert(chatConversations).values({
-                        participant1Id: user.id,
-                        participant2Handle: recipientHandle || recipientDid,
-                        lastMessageAt: new Date(),
-                        lastMessagePreview: '[Encrypted Message]'
-                    }).returning();
-                    conversation = newConv;
-                    console.log('[Chat Send] Created conversation:', conversation.id);
-                }
-
-                // Store message locally so sender can see it
-                const messageId = crypto.randomUUID();
-                const localDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost';
-                const swarmMessageId = `swarm:${localDomain}:${messageId}`;
-                
-                // Store full envelope data for decryption
-                const envelopeData = {
-                    did: user.did,
-                    handle: user.handle,
-                    ciphertext: ciphertext
-                };
-                
-                const [newMessage] = await db.insert(chatMessages).values({
-                    conversationId: conversation.id,
-                    senderHandle: user.handle,
-                    senderDisplayName: user.displayName,
-                    senderAvatarUrl: user.avatarUrl,
-                    senderNodeDomain: null, // Local sender
-                    encryptedContent: JSON.stringify(envelopeData), // Full envelope
-                    senderChatPublicKey: null, // V2 E2E - keys are in the envelope
-                    swarmMessageId,
-                    deliveredAt: null, // Will update when remote confirms
-                    readAt: null,
-                }).returning();
-                
-                console.log('[Chat Send] Stored local message:', newMessage.id);
-
-                const response = await fetch(remoteUrl, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify(body)
-                });
-
-                if (!response.ok) {
-                    const errorText = await response.text();
-                    let errorData;
-                    try {
-                        errorData = JSON.parse(errorText);
-                    } catch {
-                        errorData = { raw: errorText };
-                    }
-                    console.error('[Chat Send] Remote delivery failed:', response.status, errorData);
-                    
-                    // Check if remote node doesn't support V2 (returns V1 validation errors)
-                    const isV1ValidationError = errorData.details && 
-                        Array.isArray(errorData.details) && 
-                        errorData.details.some((d: any) => 
-                            d.path && ['messageId', 'senderHandle', 'senderNodeDomain', 'recipientHandle', 'encryptedContent', 'timestamp'].includes(d.path[0])
-                        );
-                    
-                    if (isV1ValidationError) {
-                        return NextResponse.json({ 
-                            error: 'Remote node needs update',
-                            details: 'The recipient node is running an older version that does not support the V2 chat protocol. Please ask the node administrator to update to the latest version.',
-                            remoteError: errorData 
-                        }, { status: 400 });
-                    }
-                    
-                    return NextResponse.json({ 
-                        error: 'Remote delivery failed',
-                        details: errorData 
-                    }, { status: response.status });
-                }
-
-                // Mark message as delivered since remote accepted it
-                await db.update(chatMessages)
-                    .set({ deliveredAt: new Date() })
-                    .where(eq(chatMessages.id, newMessage.id));
-                
-                console.log('[Chat Send] Message marked as delivered');
-                
-                return NextResponse.json({ success: true, remote: true, messageId: newMessage.id });
-
-            } catch (error: any) {
-                console.error('[Chat Send] Remote delivery error:', error);
-                return NextResponse.json({ 
-                    error: 'Failed to reach remote node',
-                    details: error.message 
-                }, { status: 500 });
-            }
+            // REMOTE RECIPIENT - not implemented yet
+            return NextResponse.json({ error: 'Remote delivery not yet implemented' }, { status: 501 });
         }
 
     } catch (error: any) {
-        console.error('Delivery failed:', error);
-        return NextResponse.json({ error: error.message }, { status: 400 });
+        console.error('Send failed:', error);
+        return NextResponse.json({ error: error.message }, { status: 500 });
     }
-}
+}