relay-adoption-source-bg.ts

1import { generateKeyPair } from "@stablelib/x25519";2import {3  createPairingInvitation,4  pairingInvitationUrl,5  parsePairingInvitation,6} from "../shared/pairing-invitation";7import {8  openRelayPairingSocket,9  type PairingSocket,10} from "../shared/pairing-dial";11import {12  noiseNKResponder,13  type NoiseNKSession,14} from "../shared/noise-js";15import {16  grantAdoption,17  isAdoptRequest,18  receiveFrame,19  requestAdoption,20  type AdoptRequest,21} from "../shared/vault-adopt";22import {23  derivePairingSAS,24  type PairingTransport,25} from "../shared/pairing-handshake";26import {27  bytesToHex,28  deriveRendezvousSecret,29  generatePairingRendezvousToken,30} from "../shared/rendezvous";31import { buildLocalIdentity, getDeviceName, getLocalPairingIdentity } from "./device-identity";32import { getSyncSettings, relayInForce } from "./sync-settings";33import { activateLicense, getLicenseKey, isProUser } from "./license";34import { createVaultFromRootKey, getRootKeyHex, isUnlocked, rollbackAdoptedVault } from "./vault";35import { computeVaultId } from "../shared/sync-identity";36import { upsertPairedDevice } from "./paired-devices";37import { triggerSyncIfReachable } from "./sync-trigger";3839const SOURCE_WINDOW_MS = 5 * 60 * 1000;4041function push(type: string, payload: unknown): void {42  try {43    const maybe = chrome.runtime.sendMessage({ type, payload }) as unknown;44    if (maybe && typeof (maybe as Promise<unknown>).catch === "function") {45      (maybe as Promise<unknown>).catch(() => undefined);46    }47  } catch {48    // The popup may have closed. The pending approval fails closed on cleanup.49  }50}5152let inFlight = false;53let activeSocket: PairingSocket | null = null;54// Outstanding source-side SAS confirmations, keyed by id. A map (vs the55// receiver's single slot) makes a stale decision from a previous source56// session impossible to land on the current one even if both run on the57// same background worker.58const pendingSourceSasConfirmation = new Map<string, { resolve: (ok: boolean) => void }>();5960export function isRelayAdoptionSourceInFlight(): boolean {61  return inFlight;62}6364/**65 * Occupy the non-buffering room before returning the invitation to the UI.66 * All long-term key material remains in the background service worker.67 */68export async function startRelayAdoptionSource(): Promise<{69  invitation: string;70}> {71  if (inFlight) throw new Error("adoption_source_in_progress");72  if (!isUnlocked()) throw new Error("vault_locked");73  inFlight = true;7475  let local: Awaited<ReturnType<typeof getLocalPairingIdentity>> | null = null;76  try {77    const settings = await getSyncSettings();78    const relayUrl = relayInForce(settings);79    local = await getLocalPairingIdentity();80    const token = generatePairingRendezvousToken();81    // Source side has the vault — caller checked isUnlocked — so the phone82    // can read the invitation and know it should receive the vault.83    const encoded = createPairingInvitation(relayUrl, token, "populated");84    const invitation = parsePairingInvitation(encoded);85    if (!invitation) throw new Error("invitation_generation_failed");8687    const socket = await openRelayPairingSocket(pairingInvitationUrl(invitation));88    activeSocket = socket;89    const readyLocal = local;90    void runSourceSession(91      socket,92      token,93      relayUrl,94      readyLocal,95    ).finally(() => {96      readyLocal.privateKey.fill(0);97      readyLocal.publicKey.fill(0);98      clearState();99    });100    return { invitation: encoded };101  } catch (error) {102    local?.privateKey.fill(0);103    local?.publicKey.fill(0);104    clearState();105    throw error;106  }107}108109export function cancelRelayAdoptionSource(): void {110  activeSocket?.close();111  clearState();112}113114/**115 * Onboarding pairing request — the empty extension shows a QR and the populated116 * phone scans it. The invitation carries `vaultStatus: "empty"`, which the117 * phone reads to switch into source mode and `grantAdoption` over the118 * established Noise channel. The receiver's `runReceiverSession` accepts the119 * root key and creates a local vault wrapped with the popup-supplied password.120 *121 * `password` is the local-only password the user picked on the "Set a password122 * for this device" screen; it wraps the adopted root key at rest and has no123 * relationship to the source device's password.124 */125export async function startRelayAdoptionReceiver(126  password: string,127): Promise<{ invitation: string }> {128  if (inFlight) throw new Error("adoption_receiver_in_progress");129  if (typeof password !== "string" || password.length === 0) {130    throw new Error("ADOPT_INVALID_PASSWORD");131  }132  inFlight = true;133  try {134    const settings = await getSyncSettings();135    const relayUrl = relayInForce(settings);136    const token = generatePairingRendezvousToken();137    const encoded = createPairingInvitation(relayUrl, token, "empty");138    const invitation = parsePairingInvitation(encoded);139    if (!invitation) throw new Error("invitation_generation_failed");140    const socket = await openRelayPairingSocket(pairingInvitationUrl(invitation));141    activeSocket = socket;142    void runReceiverSession(143      socket,144      token,145      relayUrl,146      password,147    ).finally(clearState);148    return { invitation: encoded };149  } catch (error) {150    clearState();151    throw error;152  }153}154155/**156 * Resolves the source-side SAS confirmation by id. Called by the message157 * handler when the popup taps Confirm/Cancel on the source's SAS screen.158 * Returns true if the id matched an in-flight confirmation. Unknown ids159 * (already resolved, timed out, or never existed) are a no-op so a late160 * popup click cannot crash anything.161 */162export function resolveSourceSasConfirmation(id: string, ok: boolean): boolean {163  const pending = pendingSourceSasConfirmation.get(id);164  if (!pending) return false;165  pendingSourceSasConfirmation.delete(id);166  pending.resolve(ok);167  return true;168}169170async function runSourceSession(171  socket: PairingSocket,172  expectedToken: string,173  relayUrl: string,174  local: Awaited<ReturnType<typeof getLocalPairingIdentity>>,175): Promise<void> {176  const timeout = setTimeout(() => socket.close(), SOURCE_WINDOW_MS);177  let noise: NoiseNKSession | undefined;178  try {179    const hello = decodeJson<{ type?: unknown; token?: unknown }>(180      await socket.receive(),181    );182    if (hello.type !== "PEACH_HELLO" || typeof hello.token !== "string" ||183        !constantTimeEqual(hello.token, expectedToken)) {184      throw new Error("invalid_invitation");185    }186    socket.send(encodeJson({187      type: "PEACH_HELLO_ACK",188      ephemeralPublicKeyHex: bytesToHex(local.publicKey),189    }));190191    const session = await noiseNKResponder(192      local.privateKey,193      local.publicKey,194      async (bytes) => socket.send(bytes),195      () => socket.receive(),196    );197    noise = session;198    const channel: PairingTransport = {199      async send(plaintext) { socket.send(session.encrypt(plaintext)); },200      async receive() { return session.decrypt(await socket.receive()); },201    };202    const request = await receiveFrame(channel);203    if (!isAdoptRequest(request)) throw new Error("expected_ADOPT_REQUEST");204205    const device = await grantAdoption(channel, request, {206      sourceIdentity: local.identity,207      pairState: {208        rendezvousSecretHex: bytesToHex(209          deriveRendezvousSecret(session.handshakeHash),210        ),211        relayUrl,212      },213      async rootKeyHex() {214        // grantAdoption calls this only after local password approval and the215        // receiver's encrypted ADOPT_CONFIRM(true).216        const value = getRootKeyHex();217        if (!value) throw new Error("vault_locked");218        return value;219      },220      async vaultId() {221        const value = getRootKeyHex();222        if (!value) throw new Error("vault_locked");223        const bytes = hexToBytes(value);224        try {225          return await computeVaultId(bytes);226        } finally {227          bytes.fill(0);228        }229      },230      async license() {231        return (await isProUser()) ? (await getLicenseKey()) ?? undefined : undefined;232      },233      onConsent: (adoptRequest) => requestConsent(234        adoptRequest,235        derivePairingSAS(session.handshakeHash),236        crypto.randomUUID(),237      ),238      upsertPairedDevice,239    });240    if (!device) {241      push("ADOPTION_SOURCE_RESULT", {242        status: "error",243        error: "adoption_rejected",244      });245      return;246    }247    push("ADOPTION_SOURCE_RESULT", { status: "complete", device });248    // The Android receiver starts its relay listener as soon as its source249    // record is durable. Try once now and once after service startup settles so250    // the newly adopted empty vault receives its first sync without another251    // user action. Both calls are best-effort and contain no user data.252    void triggerSyncIfReachable({ reason: "manual", force: true });253    setTimeout(() => {254      void triggerSyncIfReachable({ reason: "manual", force: true });255    }, 1_000);256  } catch {257    push("ADOPTION_SOURCE_RESULT", {258      status: "error",259      error: "adoption_failed",260    });261  } finally {262    clearTimeout(timeout);263    noise?.close();264    socket.close();265    pendingSourceSasConfirmation.clear();266  }267}268269/**270 * Browser receives the vault from the phone. The protocol is the mirror of271 * the source side: phone is the Noise initiator and the source of truth for272 * the SAS gate, browser is the responder that creates the vault locally.273 */274async function runReceiverSession(275  socket: PairingSocket,276  expectedToken: string,277  relayUrl: string,278  password: string,279): Promise<void> {280  const timeout = setTimeout(() => socket.close(), SOURCE_WINDOW_MS);281  // Ephemeral keypair for the NK responder half. Never persisted; zeroed on exit.282  const ephemeral = generateKeyPair();283  const ephemeralPrivate = ephemeral.secretKey;284  const ephemeralPublic = ephemeral.publicKey;285  let noise: NoiseNKSession | undefined;286  let createdVault = false;287  try {288    const hello = decodeJson<{ type?: unknown; token?: unknown }>(289      await socket.receive(),290    );291    if (hello.type !== "PEACH_HELLO" || typeof hello.token !== "string" ||292        !constantTimeEqual(hello.token, expectedToken)) {293      throw new Error("invalid_invitation");294    }295    socket.send(encodeJson({296      type: "PEACH_HELLO_ACK",297      ephemeralPublicKeyHex: bytesToHex(ephemeralPublic),298    }));299300    const session = await noiseNKResponder(301      ephemeralPrivate,302      ephemeralPublic,303      async (bytes) => socket.send(bytes),304      () => socket.receive(),305    );306    noise = session;307    const channel: PairingTransport = {308      async send(plaintext) { socket.send(session.encrypt(plaintext)); },309      async receive() { return session.decrypt(await socket.receive()); },310    };311312    const deviceName = await getDeviceName();313314    const device = await requestAdoption(channel, {315      deviceName,316      generateDeviceId: () => crypto.randomUUID(),317      // Auto-accept the SAS: both sides derive it from the same Noise318      // handshake hash, so the codes match by construction. Requiring the user319      // to confirm on both sides creates a race where the phone can time out320      // waiting for ADOPT_CONFIRM before the browser's popup is reached. The321      // phone's onConsent is the single user gate; this side just proceeds.322      // Still show the locally derived code for visual verification.323      async confirmSas() {324        push("ADOPTION_SOURCE_SAS", {325          sas: derivePairingSAS(session.handshakeHash),326          displayOnly: true,327        });328        return true;329      },330      async createVaultFromRootKey(rootKeyHex) {331        // Direct call, not chrome.runtime.sendMessage — a service worker332        // calling sendMessage does not reach its own listener (returns333        // undefined), and the receiver already lives in the same SW context334        // as the vault module. Round-tripping through the message bus was335        // the root cause of "create_vault_no_response".336        const { vaultId } = await createVaultFromRootKey(password, rootKeyHex);337        createdVault = true;338        return { vaultId };339      },340      async applyLicense(license) {341        // Direct call, not chrome.runtime.sendMessage — same sendMessage-to-self342        // issue as createVaultFromRootKey. SW can't reach its own listener.343        await activateLicense(license);344      },345      async deriveLocalIdentity() {346        // Direct call for the same reason as applyLicense above.347        const masterKeyHex = getRootKeyHex();348        if (!masterKeyHex) throw new Error("identity_unavailable");349        const masterKey = hexToBytes(masterKeyHex);350        try {351          return await buildLocalIdentity(masterKey);352        } finally {353          masterKey.fill(0);354        }355      },356      async upsertPairedDevice(paired) {357        // Direct call for the same reason as applyLicense above.358        await upsertPairedDevice(paired);359      },360      pairState: {361        rendezvousSecretHex: bytesToHex(deriveRendezvousSecret(session.handshakeHash)),362        relayUrl,363      },364      onError(error) {365        push("ADOPTION_SOURCE_RESULT", { status: "error", error });366      },367    });368369    if (!device) {370      if (createdVault) {371        await rollbackAdoptedVault();372        createdVault = false;373      }374      push("ADOPTION_SOURCE_RESULT", {375        status: "error",376        error: "adoption_rejected",377      });378      return;379    }380    push("ADOPTION_SOURCE_RESULT", { status: "complete", device });381    createdVault = false;382    void triggerSyncIfReachable({ reason: "manual", force: true });383  } catch (error) {384    if (createdVault) {385      try {386        await rollbackAdoptedVault();387        createdVault = false;388      } catch (rollbackError) {389        console.error("[Peach] rollback failed:", rollbackError);390      }391    }392    console.error("[Peach] receiver session failed:", error);393    push("ADOPTION_SOURCE_RESULT", {394      status: "error",395      error: error instanceof Error ? error.message : "adoption_failed",396    });397  } finally {398    clearTimeout(timeout);399    noise?.close();400    socket.close();401    ephemeralPrivate.fill(0);402    ephemeralPublic.fill(0);403  }404}405406/**407 * Push the SAS to the popup, then block until the popup responds via the408 * `SOURCE_SAS_DECISION` message or the timeout fires. Returns false on409 * timeout or cancel so the adoption aborts before any vault state changes.410 *411 * The pending deferred MUST be installed before the push: a popup-side412 * auto-approver (test mocks, future automation) can synchronously resolve413 * the deferred the moment it sees the SAS push, and a missing slot would414 * drop that approval on the floor.415 */416function waitForSourceSasConfirmation(417  id: string,418  request: AdoptRequest,419  sas: string,420): Promise<boolean> {421  return new Promise<boolean>((resolve) => {422    const timer = setTimeout(() => {423      pendingSourceSasConfirmation.delete(id);424      resolve(false);425    }, SOURCE_WINDOW_MS);426    pendingSourceSasConfirmation.set(id, {427      resolve: (ok) => {428        clearTimeout(timer);429        resolve(ok);430      },431    });432    push("ADOPTION_SOURCE_SAS", {433      id,434      sas,435      receiverDeviceName: request.device_name,436    });437  });438}439440/**441 * Opening Add Device in an unlocked extension is the source-side authorization.442 * Announce the SAS for comparison, then let the scanning device's explicit443 * confirmation be the single commit gate. grantAdoption still refuses to send444 * the root key until the receiver returns ADOPT_CONFIRM(true).445 */446function requestConsent(request: AdoptRequest, sas: string, id: string): Promise<boolean> {447  return waitForSourceSasConfirmation(id, request, sas);448}449450function clearState(): void {451  activeSocket = null;452  inFlight = false;453  pendingSourceSasConfirmation.clear();454}455456function constantTimeEqual(a: string, b: string): boolean {457  if (a.length !== b.length) return false;458  let diff = 0;459  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);460  return diff === 0;461}462463function encodeJson(value: unknown): Uint8Array {464  return new TextEncoder().encode(JSON.stringify(value));465}466467function decodeJson<T>(value: Uint8Array): T {468  return JSON.parse(new TextDecoder().decode(value)) as T;469}470471function hexToBytes(hex: string): Uint8Array {472  const out = new Uint8Array(hex.length / 2);473  for (let i = 0; i < out.length; i++) {474    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);475  }476  return out;477}