Files
ChatApp/apps/desktop/src/lib/secretStore.ts
T
byGalax 49c64cc5d9
Release desktop app / build (, windows-latest) (push) Has been cancelled
Release desktop app / build (--target universal-apple-darwin --bundles app,updater, macos-14) (push) Has been cancelled
feat(crypto): self-rolled encrypted file vault, replaces flaky stronghold
2026-04-19 21:21:40 +02:00

77 lines
2.6 KiB
TypeScript

import { base64FromBytes, bytesFromBase64, type SecretStore } from '@chat-app/shared/auth';
import { isTauriRuntime } from './globalShortcut';
import { makeSecureFileStore, migrateLocalStorageToVault } from './secureFileStore';
// Two-tier SecretStore:
// - Tauri runtime: encrypted single-file vault in `appLocalDataDir`
// (`secureFileStore` — XSalsa20-Poly1305 + Argon2id KDF). Survives app
// reinstalls when the OS preserves the data dir.
// - Web / pre-auth: plain localStorage (legacy fallback).
//
// Callers import `devLocalSecretStore` and call `setSecretStoreUser(userId)`
// once the session is known. The singleton object's identity is stable so
// existing imports keep working.
const PREFIX = 'chatapp.secret:';
const localStore: SecretStore = {
async getSecret(key: string): Promise<Uint8Array | null> {
const raw = window.localStorage.getItem(PREFIX + key);
if (!raw) return null;
return bytesFromBase64(raw);
},
async setSecret(key: string, value: Uint8Array): Promise<void> {
const encoded = await base64FromBytes(value);
window.localStorage.setItem(PREFIX + key, encoded);
},
async removeSecret(key: string): Promise<void> {
window.localStorage.removeItem(PREFIX + key);
},
};
let activeBackend: SecretStore = localStore;
let activeUserId: string | null = null;
export async function setSecretStoreUser(userId: string | null): Promise<void> {
if (userId === activeUserId) return;
activeUserId = userId;
if (userId && isTauriRuntime()) {
const fileStore = makeSecureFileStore(userId);
try {
// Probe write/read to confirm the vault is usable on this machine.
// If anything throws (perm denied, disk full, KDF error), fall back to
// localStorage so the rest of the app keeps working.
await fileStore.getSecret('__probe');
activeBackend = fileStore;
try {
await migrateLocalStorageToVault(userId, PREFIX);
} catch (err: unknown) {
console.warn('vault migration failed', err);
}
} catch (err: unknown) {
console.warn('secure file vault init failed — falling back to localStorage', err);
activeBackend = localStore;
}
} else {
activeBackend = localStore;
}
}
export const devLocalSecretStore: SecretStore = {
async getSecret(key) {
return activeBackend.getSecret(key);
},
async setSecret(key, value) {
return activeBackend.setSecret(key, value);
},
async removeSecret(key) {
return activeBackend.removeSecret(key);
},
};
export function isEncryptedVaultActive(): boolean {
return activeBackend !== localStore;
}