feat(crypto): sender-key per-conversation multi-device E2EE

apps/desktop/src/lib/useConversationMessages.ts

@@ -1,18 +1,16 @@
 import { loadDevicePrivateKey } from '@chat-app/shared/auth';
 import {
   type AttachmentHandle,
-  type ChatMessage,
   type DecryptedMessage,
   decryptMessages,
   encryptAndUploadAttachment,
   fetchConversationMessages,
-  fetchOwnEnvelopes,
-  fetchSenderDeviceKeys,
   insertAttachmentRow,
   MAX_ATTACHMENT_BYTES,
+  type MessageWithCipher,
   sendEncryptedMessage,
 } from '@chat-app/shared/chat';
-import { bytesToPgHex } from '@chat-app/shared/supabase';
+import { bytesToPgHex, pgHexToBytes } from '@chat-app/shared/supabase';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import { devLocalSecretStore } from './secretStore';
@@ -36,7 +34,7 @@ type MessageChangePayload = {
   old: Record<string, unknown>;
 };
 
-function rowToMessage(row: Record<string, unknown>): ChatMessage {
+function rowToMessage(row: Record<string, unknown>): MessageWithCipher {
   return {
     id: String(row.id),
     conversationId: String(row.conversation_id),
@@ -46,6 +44,9 @@ function rowToMessage(row: Record<string, unknown>): ChatMessage {
     editedAt: row.edited_at ? String(row.edited_at) : null,
     deletedAt: row.deleted_at ? String(row.deleted_at) : null,
     createdAt: String(row.created_at),
+    ciphertext: pgHexToBytes(String(row.ciphertext ?? '\\x')),
+    nonce: pgHexToBytes(String(row.nonce ?? '\\x')),
+    keyVersion: typeof row.key_version === 'number' ? row.key_version : 1,
   };
 }
 
@@ -66,23 +67,15 @@ export function useConversationMessages({ conversationId, userId, deviceId }: Ar
   }, [userId, deviceId]);
 
   const decryptBatch = useCallback(
-    async (messages: ChatMessage[]): Promise<DecryptedMessage[]> => {
+    async (messages: MessageWithCipher[]): Promise<DecryptedMessage[]> => {
       const priv = privateKeyRef.current;
       if (!priv || !deviceId || messages.length === 0) {
         return messages.map((m) => ({ ...m, plaintext: null }));
       }
-      const ids = messages.map((m) => m.id);
-      const senderDeviceIds = messages
-        .map((m) => m.senderDeviceId)
-        .filter((v): v is string => v != null);
-      const [envelopes, senderKeys] = await Promise.all([
-        fetchOwnEnvelopes(supabase, ids, deviceId),
-        fetchSenderDeviceKeys(supabase, senderDeviceIds),
-      ]);
       return decryptMessages({
+        client: supabase,
         messages,
-        envelopes,
-        senderKeys,
+        ownDeviceId: deviceId,
         ownPrivateKey: priv,
       });
     },