encrypt pair rendezvous secrets under vault-root wrapping key (PB-26-213, v5.0.60)

@@ -0,0 +1,251 @@1+import { beforeEach, describe, expect, it, vi } from "vitest";2+3+import { isRouteCapableMeshPeer } from "../shared/mesh-peer-role";4+import type { PairedDevice } from "../shared/sync-types";5+6+// PB-26-213: the reusable rendezvous secret must never sit in plaintext in7+// chrome.storage.local. It lives in an authenticated encrypted record under8+// a vault-root-derived wrapping key, with only a trusted-session operational9+// copy outside ciphertext.10+11+type StorageShape = Record<string, unknown>;12+13+const SECRET_A = "aa".repeat(32);14+const SECRET_B = "bb".repeat(32);15+const ROOT_KEY = new Uint8Array(32).fill(0x42);16+const WRONG_KEY = new Uint8Array(32).fill(0x99);17+18+function publicRow(deviceId: string): PairedDevice {19+  return {20+    deviceId,21+    deviceName: deviceId,22+    deviceType: "android",23+    longTermPublicKeyHex: "ab".repeat(32),24+    signingPublicKeyHex: "cd".repeat(32),25+    trustSource: "direct",26+    relayUrl: "wss://relay.example.com",27+    pairedAt: 1_700_000_000_000,28+  };29+}30+31+function legacyRow(deviceId: string, secret: string): PairedDevice {32+  return { ...publicRow(deviceId), rendezvousSecretHex: secret };33+}34+35+function rawLocalContainsSecret(local: StorageShape, secret: string): boolean {36+  return JSON.stringify(local).includes(secret);37+}38+39+describe("encrypted pair secrets (PB-26-213)", () => {40+  let local: StorageShape;41+  let session: StorageShape;42+43+  beforeEach(() => {44+    vi.resetModules();45+    local = {};46+    session = {};47+    const area = (store: StorageShape) => ({48+      get: vi.fn(async (key?: string | string[]) => {49+        if (!key) return store;50+        if (typeof key === "string") return { [key]: store[key] };51+        return key.reduce<Record<string, unknown>>((r, k) => { r[k] = store[k]; return r; }, {});52+      }),53+      set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(store, next); }),54+      remove: vi.fn(async (keys: string | string[]) => {55+        for (const k of Array.isArray(keys) ? keys : [keys]) delete store[k];56+      }),57+      clear: vi.fn(async () => {58+        for (const k of Object.keys(store)) delete store[k];59+      }),60+    });61+    (globalThis as { chrome?: typeof chrome }).chrome = {62+      storage: { local: area(local), session: area(session) },63+      alarms: { clear: vi.fn(), create: vi.fn(), onAlarm: { addListener: vi.fn() } },64+      idle: { setDetectionInterval: vi.fn(), onStateChanged: { addListener: vi.fn() } },65+    } as unknown as typeof chrome;66+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("network disabled"); }));67+  });68+69+  it("fresh pairing writes no reusable secret to storage.local outside ciphertext", async () => {70+    const { upsertPairedDevice } = await import("./paired-devices");71+    const { setPairSecret, getPairSecret } = await import("./pair-secrets");72+73+    await upsertPairedDevice(legacyRow("pixel-1", SECRET_A));74+    await setPairSecret("pixel-1", SECRET_A, ROOT_KEY);75+76+    expect(rawLocalContainsSecret(local, SECRET_A)).toBe(false);77+    expect(local.peach_pair_secrets_v1).toBeDefined();78+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);79+  });80+81+  it("upsertPairedDevice never persists a rendezvous secret into the public registry", async () => {82+    const { listPairedDevices, upsertPairedDevice } = await import("./paired-devices");83+84+    await upsertPairedDevice(legacyRow("pixel-1", SECRET_A));85+86+    const rows = await listPairedDevices();87+    expect(rows).toHaveLength(1);88+    expect(rows[0]!.rendezvousSecretHex).toBeUndefined();89+    expect(rawLocalContainsSecret(local, SECRET_A)).toBe(false);90+  });91+92+  it("migration preserves every valid secret and scrubs plaintext only after verified persistence", async () => {93+    const { listPairedDevices } = await import("./paired-devices");94+    const { reconcilePairSecrets, getPairSecret } = await import("./pair-secrets");95+96+    local.peach_paired_devices_v3 = [legacyRow("pixel-1", SECRET_A), legacyRow("pixel-2", SECRET_B)];97+98+    const first = await reconcilePairSecrets(ROOT_KEY);99+    expect(first.migrated).toBe(2);100+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);101+    expect(await getPairSecret("pixel-2", null)).toBe(SECRET_B);102+103+    // Plaintext source is gone only now that the encrypted write verified.104+    for (const row of await listPairedDevices()) {105+      expect(row.rendezvousSecretHex).toBeUndefined();106+    }107+    expect(rawLocalContainsSecret(local, SECRET_A)).toBe(false);108+    expect(rawLocalContainsSecret(local, SECRET_B)).toBe(false);109+110+    // Idempotent across failures between steps: a second run changes nothing.111+    const second = await reconcilePairSecrets(ROOT_KEY);112+    expect(second.migrated).toBe(0);113+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);114+  });115+116+  it("a wrong wrapping key cannot read the map", async () => {117+    const { setPairSecret, getPairSecret } = await import("./pair-secrets");118+119+    await setPairSecret("pixel-1", SECRET_A, ROOT_KEY);120+    // Drop the trusted-session copy so only the crypto boundary remains.121+    for (const k of Object.keys(session)) delete session[k];122+    const wrongHex = Array.from(WRONG_KEY).map((b) => b.toString(16).padStart(2, "0")).join("");123+    expect(await getPairSecret("pixel-1", wrongHex)).toBeNull();124+  });125+126+  it("unlock populates the trusted-session cache; a wiped session requires unlock", async () => {127+    const { setPairSecret, getPairSecret } = await import("./pair-secrets");128+129+    await setPairSecret("pixel-1", SECRET_A, ROOT_KEY);130+    // Locked (no root key): the session-scoped operational copy serves sync.131+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);132+133+    // Full browser restart clears the session: sync stays dormant until unlock.134+    for (const k of Object.keys(session)) delete session[k];135+    expect(await getPairSecret("pixel-1", null)).toBeNull();136+137+    // ...but an unlocked caller still reads through the root key.138+    const rootHex = Array.from(ROOT_KEY).map((b) => b.toString(16).padStart(2, "0")).join("");139+    expect(await getPairSecret("pixel-1", rootHex)).toBe(SECRET_A);140+  });141+142+  it("unpair prunes the secret; re-pair replaces it without orphan records", async () => {143+    const { removePairedDeviceById, listPairedDevices } = await import("./paired-devices");144+    const { reconcilePairSecrets, setPairSecret, getPairSecret } = await import("./pair-secrets");145+146+    local.peach_paired_devices_v3 = [publicRow("pixel-1"), publicRow("pixel-2")];147+    await setPairSecret("pixel-1", SECRET_A, ROOT_KEY);148+    await setPairSecret("pixel-2", SECRET_B, ROOT_KEY);149+150+    await removePairedDeviceById("pixel-2");151+    expect((await listPairedDevices()).map((d) => d.deviceId)).toEqual(["pixel-1"]);152+    await reconcilePairSecrets(ROOT_KEY);153+    expect(await getPairSecret("pixel-2", null)).toBeNull();154+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);155+156+    await setPairSecret("pixel-2", SECRET_A, ROOT_KEY);157+    local.peach_paired_devices_v3 = [...(local.peach_paired_devices_v3 as PairedDevice[]), publicRow("pixel-2")];158+    await reconcilePairSecrets(ROOT_KEY);159+    expect(await getPairSecret("pixel-2", null)).toBe(SECRET_A);160+  });161+162+  it("registry rows without secrets stay route-capable; the secret resolves at dial time", () => {163+    expect(isRouteCapableMeshPeer(publicRow("pixel-1"))).toBe(true);164+  });165+});166+167+describe("pair-secret vault lifecycle (PB-26-213)", () => {168+  let local: StorageShape;169+  let session: StorageShape;170+171+  beforeEach(() => {172+    vi.resetModules();173+    local = {};174+    session = {};175+    const area = (store: StorageShape) => ({176+      get: vi.fn(async (key?: string | string[]) => {177+        if (!key) return store;178+        if (typeof key === "string") return { [key]: store[key] };179+        return key.reduce<Record<string, unknown>>((r, k) => { r[k] = store[k]; return r; }, {});180+      }),181+      set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(store, next); }),182+      remove: vi.fn(async (keys: string | string[]) => {183+        for (const k of Array.isArray(keys) ? keys : [keys]) delete store[k];184+      }),185+      clear: vi.fn(async () => {186+        for (const k of Object.keys(store)) delete store[k];187+      }),188+    });189+    (globalThis as { chrome?: typeof chrome }).chrome = {190+      storage: { local: area(local), session: area(session) },191+      alarms: { clear: vi.fn(), create: vi.fn(), onAlarm: { addListener: vi.fn() } },192+      idle: { setDetectionInterval: vi.fn(), onStateChanged: { addListener: vi.fn() } },193+    } as unknown as typeof chrome;194+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("network disabled"); }));195+  });196+197+  function hexToBytes(value: string): Uint8Array {198+    const out = new Uint8Array(value.length / 2);199+    for (let i = 0; i < value.length; i += 2) out[i / 2] = parseInt(value.slice(i, i + 2), 16);200+    return out;201+  }202+203+  it("password change retains access; rotation clears the map", async () => {204+    const vault = await import("./vault");205+    const { getPairSecret, setPairSecret } = await import("./pair-secrets");206+    await vault.createVault("strong-pass-abc123");207+    await vault.unlock("strong-pass-abc123");208+209+    const root = hexToBytes(vault.getRootKeyHex()!);210+    try {211+      await setPairSecret("pixel-1", SECRET_A, root);212+    } finally {213+      root.fill(0);214+    }215+216+    expect(await vault.changePassword("strong-pass-abc123", "new-pass-xyz789")).toBe(true);217+    expect(await getPairSecret("pixel-1", vault.getRootKeyHex())).toBe(SECRET_A);218+219+    expect((await vault.rotateSyncIdentity()).ok).toBe(true);220+    expect(await getPairSecret("pixel-1", vault.getRootKeyHex())).toBeNull();221+    expect(local.peach_pair_secrets_v1).toBeUndefined();222+    expect(session.peach_pair_secrets_session).toBeUndefined();223+  });224+225+  it("decoy unlock drops the session copy; real re-unlock restores service", async () => {226+    const vault = await import("./vault");227+    const { upsertPairedDevice } = await import("./paired-devices");228+    const { getPairSecret, setPairSecret } = await import("./pair-secrets");229+    await vault.createVault("strong-pass-abc123");230+    await vault.unlock("strong-pass-abc123");231+232+    await upsertPairedDevice(publicRow("pixel-1"));233+    const root = hexToBytes(vault.getRootKeyHex()!);234+    try {235+      await setPairSecret("pixel-1", SECRET_A, root);236+    } finally {237+      root.fill(0);238+    }239+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);240+241+    await vault.setupDuress("decoy-password-67890");242+    await vault.lock();243+    expect(await vault.unlock("decoy-password-67890")).toBe(true);244+    expect(await getPairSecret("pixel-1", null)).toBeNull();245+    expect(session.peach_pair_secrets_session).toBeUndefined();246+247+    await vault.lock();248+    expect(await vault.unlock("strong-pass-abc123")).toBe(true);249+    expect(await getPairSecret("pixel-1", null)).toBe(SECRET_A);250+  });251+});

@@ -0,0 +1,280 @@1+/**2+ * pair-secrets.ts — PB-26-213: the reusable rendezvous secret must never sit3+ * in plaintext in chrome.storage.local.4+ *5+ * Public routing metadata stays in the `peach_paired_devices_v3` registry;6+ * the secrets live in a separate AES-256-GCM record under a wrapping key7+ * derived from the vault root key (HKDF-SHA256, domain-separated label).8+ * Only a trusted-session operational copy exists outside ciphertext, so9+ * locked sync keeps working for the browser session without any disk copy.10+ *11+ * This module never imports vault.ts (vault.ts imports this module): every12+ * function that needs root-key material takes it as a parameter.13+ */14+import { HKDF } from "@stablelib/hkdf";15+import { SHA256 } from "@stablelib/sha256";16+17+import { decrypt, encrypt, zeroKey } from "./aes";18+import { listPairedDevices, writePairedDevices } from "./paired-devices";19+20+const RECORD_KEY = "peach_pair_secrets_v1";21+const SESSION_KEY = "peach_pair_secrets_session";22+const RECORD_VERSION = 1;23+const AAD = "peach-pair-secrets-v1";24+const WRAP_INFO = new TextEncoder().encode("peach-pair-secrets-v1");25+const EMPTY_SALT = new Uint8Array(0);26+27+export type PairSecretMap = Record<string, string>;28+29+// PB-26-203: the session operational copy is only written/read where startup30+// positively established trusted-only session storage. Defaults to allowed31+// so direct imports keep working; vault.applyStorageHardening sets the real32+// value before the first restore.33+let sessionAllowed = true;34+35+export function setSessionAllowed(allowed: boolean): void {36+  sessionAllowed = allowed;37+}38+39+export function isValidPairSecret(value: unknown): value is string {40+  return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);41+}42+43+function wrappingKey(rootKey: Uint8Array): Uint8Array {44+  if (rootKey.length !== 32) throw new Error("pair_secrets_root_key_invalid");45+  return new HKDF(SHA256, rootKey, EMPTY_SALT, WRAP_INFO).expand(32);46+}47+48+function hexToBytes(value: string): Uint8Array {49+  const out = new Uint8Array(value.length / 2);50+  for (let i = 0; i < value.length; i += 2) {51+    out[i / 2] = parseInt(value.slice(i, i + 2), 16);52+  }53+  return out;54+}55+56+type SecretEnvelope = { v: number; nonce: string; ciphertext: string; tag: string };57+58+function isEnvelope(value: unknown): value is SecretEnvelope {59+  if (typeof value !== "object" || value === null) return false;60+  const r = value as Record<string, unknown>;61+  return (62+    r.v === RECORD_VERSION &&63+    typeof r.nonce === "string" &&64+    typeof r.ciphertext === "string" &&65+    typeof r.tag === "string"66+  );67+}68+69+function sanitizeMap(value: unknown): PairSecretMap {70+  if (typeof value !== "object" || value === null) return {};71+  const out: PairSecretMap = {};72+  for (const [deviceId, secret] of Object.entries(value as Record<string, unknown>)) {73+    if (typeof deviceId === "string" && deviceId && isValidPairSecret(secret)) {74+      out[deviceId] = secret;75+    }76+  }77+  return out;78+}79+80+async function readEncryptedMap(rootKey: Uint8Array): Promise<PairSecretMap> {81+  let stored: unknown;82+  try {83+    const result = await chrome.storage.local.get(RECORD_KEY);84+    stored = (result as Record<string, unknown>)[RECORD_KEY];85+  } catch {86+    return {};87+  }88+  if (stored === undefined) return {};89+  if (!isEnvelope(stored)) return {};90+  const wrap = wrappingKey(rootKey);91+  try {92+    return sanitizeMap(JSON.parse(await decrypt(wrap, stored.nonce, stored.ciphertext, stored.tag, AAD)));93+  } catch {94+    // Wrong key or corrupt record: fail closed, never partial state.95+    return {};96+  } finally {97+    zeroKey(wrap);98+  }99+}100+101+async function writeEncryptedMap(rootKey: Uint8Array, map: PairSecretMap): Promise<void> {102+  const wrap = wrappingKey(rootKey);103+  try {104+    const sealed = await encrypt(wrap, JSON.stringify(map), AAD);105+    await chrome.storage.local.set({ [RECORD_KEY]: { v: RECORD_VERSION, ...sealed } });106+  } finally {107+    zeroKey(wrap);108+  }109+}110+111+async function writeSessionCache(map: PairSecretMap): Promise<void> {112+  if (!sessionAllowed || !chrome.storage.session) return;113+  try {114+    await chrome.storage.session.set({ [SESSION_KEY]: map });115+  } catch {116+    // Session storage is quota-bound; losing locked sync for the session is117+    // preferable to failing the caller (same rule as the locked-sync spool).118+  }119+}120+121+async function readSessionCache(): Promise<PairSecretMap> {122+  if (!sessionAllowed || !chrome.storage.session) return {};123+  try {124+    const result = await chrome.storage.session.get(SESSION_KEY);125+    return sanitizeMap((result as Record<string, unknown>)[SESSION_KEY]);126+  } catch {127+    return {};128+  }129+}130+131+async function clearSessionCache(): Promise<void> {132+  if (!chrome.storage.session) return;133+  try {134+    await chrome.storage.session.remove(SESSION_KEY);135+  } catch {136+    // Best effort: a stale operational copy is bounded by the browser session.137+  }138+}139+140+/**141+ * Resolve one device's rendezvous secret: trusted-session copy first, then142+ * the encrypted record when the caller holds the root key (unlocked).143+ * Returns null when neither path can serve — sync then stays dormant.144+ */145+export async function getPairSecret(146+  deviceId: string,147+  rootKeyHex: string | null,148+): Promise<string | null> {149+  const cached = await readSessionCache();150+  const hit = cached[deviceId];151+  if (isValidPairSecret(hit)) return hit;152+  if (!rootKeyHex || !/^[0-9a-f]{64}$/.test(rootKeyHex)) return null;153+  const rootKey = hexToBytes(rootKeyHex);154+  try {155+    const map = await readEncryptedMap(rootKey);156+    const secret = map[deviceId];157+    return isValidPairSecret(secret) ? secret : null;158+  } finally {159+    zeroKey(rootKey);160+  }161+}162+163+/**164+ * Store (or replace) one device's secret: encrypted record plus session copy.165+ * Pair/re-pair paths call this after upserting the public registry row.166+ */167+export async function setPairSecret(168+  deviceId: string,169+  secretHex: string,170+  rootKey: Uint8Array,171+): Promise<void> {172+  if (!deviceId || !isValidPairSecret(secretHex)) throw new Error("pair_secret_invalid");173+  const map = await readEncryptedMap(rootKey);174+  map[deviceId] = secretHex;175+  await writeEncryptedMap(rootKey, map);176+  const cached = await readSessionCache();177+  cached[deviceId] = secretHex;178+  await writeSessionCache(cached);179+}180+181+/**182+ * Bring the encrypted record, the public registry, and the session cache183+ * into agreement: adopt valid legacy plaintext secrets, drop entries for184+ * devices no longer in the registry (unpair/revoke/repair), persist only185+ * after a verified read-back, and scrub the plaintext source last.186+ * Idempotent — safe to run on every real-vault unlock and to retry after187+ * an interruption at any step.188+ */189+export async function reconcilePairSecrets(190+  rootKey: Uint8Array,191+): Promise<{ migrated: number }> {192+  const devices = await listPairedDevices();193+  const registryIds = new Set(devices.map((d) => d.deviceId));194+  const legacy = new Map<string, string>();195+  for (const device of devices) {196+    if (isValidPairSecret(device.rendezvousSecretHex)) {197+      legacy.set(device.deviceId, device.rendezvousSecretHex);198+    }199+  }200+201+  const map = await readEncryptedMap(rootKey);202+  let migrated = 0;203+  for (const [deviceId, secret] of legacy) {204+    if (map[deviceId] !== secret) {205+      map[deviceId] = secret;206+      migrated += 1;207+    }208+  }209+  let pruned = false;210+  for (const deviceId of Object.keys(map)) {211+    if (!registryIds.has(deviceId)) {212+      delete map[deviceId];213+      pruned = true;214+    }215+  }216+217+  // Persist only when something actually changed; a fresh vault with no218+  // pairs writes nothing.219+  if (migrated > 0 || pruned || legacy.size > 0 || Object.keys(map).length > 0) {220+    await writeEncryptedMap(rootKey, map);221+    // Crash safety: re-read and verify before touching the plaintext source.222+    const verified = await readEncryptedMap(rootKey);223+    for (const [deviceId, secret] of legacy) {224+      if (verified[deviceId] !== secret) throw new Error("pair_secrets_verify_failed");225+    }226+    if (legacy.size > 0) {227+      await writePairedDevices(228+        devices.map((device) => {229+          if (!isValidPairSecret(device.rendezvousSecretHex)) return device;230+          const { rendezvousSecretHex: _dropped, ...pub } = device;231+          return pub;232+        }),233+      );234+    }235+  }236+237+  await writeSessionCache(map);238+  return { migrated };239+}240+241+/** Rotation drops all peers, so the secret map is cleared with the registry. */242+export async function clearPairSecrets(): Promise<void> {243+  try {244+    await chrome.storage.local.remove(RECORD_KEY);245+  } catch {246+    // Best effort alongside the registry clear it accompanies.247+  }248+  await clearSessionCache();249+}250+251+/**252+ * Drop the trusted-session operational copy without touching the encrypted253+ * record. Decoy unlocks call this: a duress session must never serve the254+ * real pair-secret map, and the next real unlock re-populates the copy.255+ */256+export async function dropSessionCache(): Promise<void> {257+  await clearSessionCache();258+}259+260+/**261+ * Forget one device immediately (unpair/revoke): the session copy is always262+ * removed; the encrypted entry is removed too when the caller holds the root263+ * key. Orphans left behind by locked-state removals are pruned by the next264+ * reconcile.265+ */266+export async function dropPairSecret(267+  deviceId: string,268+  rootKey: Uint8Array | null,269+): Promise<void> {270+  const cached = await readSessionCache();271+  if (cached[deviceId] !== undefined) {272+    delete cached[deviceId];273+    await writeSessionCache(cached);274+  }275+  if (!rootKey) return;276+  const map = await readEncryptedMap(rootKey);277+  if (map[deviceId] === undefined) return;278+  delete map[deviceId];279+  await writeEncryptedMap(rootKey, map);280+}