chore: use crypto package everywhere

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
       - run: bun lint:ci
       - run: bun tsc --noEmit
       - uses: supercharge/mongodb-github-action@1.12.0
-      - run: RUN_MONGO_TESTS=1 bun test packages/federation-sdk/src/services/state.service.spec.ts packages/federation-sdk/src/services/room.service.spec.ts
+      - run: LOG_LEVEL=debug bun run test:withMongo
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v5
         with:

.vscode/settings.json

@@ -14,5 +14,14 @@
 	"[typescript]": {
 		"editor.defaultFormatter": "biomejs.biome"
 	},
-	"typescript.enablePromptUseWorkspaceTsdk": true
-  }
+	"typescript.enablePromptUseWorkspaceTsdk": true,
+	"[json]": {
+		"editor.defaultFormatter": "biomejs.biome"
+	},
+	"[jsonc]": {
+		"editor.defaultFormatter": "biomejs.biome"
+	},
+	"[javascript]": {
+		"editor.defaultFormatter": "biomejs.biome"
+	}
+}

package.json

@@ -49,6 +49,7 @@
 		"test": "bun test",
 		"build": "turbo build",
 		"test:coverage": "bun test --coverage",
+		"test:withMongo": "export RUN_MONGO_TESTS=1; grep -r runIfMongoExists packages/federation-sdk/src/services/ | awk -F: '/spec/ { print $1 }' | xargs bun test {}",
 		"lint": "bunx @biomejs/biome lint --diagnostic-level=error",
 		"lint:ci": "bunx @biomejs/biome ci --diagnostic-level=error",
 		"lint:fix": "bunx @biomejs/biome lint --fix",

packages/core/src/index.ts

@@ -1,6 +1,6 @@
 // Types
 export { EncryptionValidAlgorithm } from './types';
-export type { SignedEvent, SigningKey } from './types';
+export type * from './types';
 
 // Event utilities
 export { signEvent } from './utils/signEvent';

packages/core/src/types.ts

@@ -24,3 +24,35 @@ export type SigningKey = {
 	publicKey: Uint8Array;
 	sign(data: Uint8Array): Promise<Uint8Array>;
 };
+
+export type KeyV2ServerResponse = {
+	// still valid for signing events
+	old_verify_keys: Record<
+		string,
+		{
+			expired_ts: number;
+			key: string;
+		}
+	>;
+	server_name: string;
+	signatures: Record<string, Record<string, string>>;
+	valid_until_ts: number;
+	// only federation requests
+	verify_keys: Record<
+		string, // keyAlgo:algoVersion => KeyId
+		{
+			key: string; // base64 encoded
+		}
+	>;
+};
+
+export type ServerKey = {
+	serverName: string;
+	keyId: string;
+	key: string;
+	pem: string;
+
+	_createdAt: Date;
+	_updatedAt: Date;
+	expiresAt: Date;
+};

packages/core/src/utils/fetch.ts

@@ -177,7 +177,7 @@ export async function fetch<T>(
 					body() {
 						if (!body) {
 							body = new Promise<Buffer>((resBody, rejBody) => {
-								// TODO: Make @hs/core fetch size limit configurable
+								// TODO: Make @rocket.chat/federation-core fetch size limit configurable
 								let total = 0;
 								const MAX_RESPONSE_BYTES = 50 * 1024 * 1024; // 50 MB
 
@@ -233,7 +233,7 @@ export async function fetch<T>(
 				reject(err);
 			});
 
-			// TODO: Make @hs/core fetch timeout configurable
+			// TODO: Make @rocket.chat/federation-core fetch timeout configurable
 			request.setTimeout(20_000, () => {
 				request.destroy(new Error('Request timed out after 20s'));
 			});

packages/crypto/src/index.ts

@@ -6,6 +6,7 @@ export {
 	toBinaryData,
 	fromBinaryData,
 	fromBase64ToBytes,
+	InvalidSignatureError,
 } from './utils/data-types';
 
 export { isValidAlgorithm } from './utils/constants';

packages/crypto/src/keys/ed25519.ts

@@ -6,6 +6,7 @@ import {
 	ed25519PublicKeyRawToPem,
 } from '../rfc/8410/ed25519-pem';
 import { EncryptionValidAlgorithm } from '../utils/constants';
+import { InvalidSignatureError } from '../utils/data-types';
 
 export class Ed25519VerifierKeyImpl implements VerifierKey {
 	algorithm = EncryptionValidAlgorithm.ed25519;
@@ -44,7 +45,7 @@ export class Ed25519VerifierKeyImpl implements VerifierKey {
 					} else if (verified) {
 						resolve();
 					} else {
-						reject(new Error('Invalid signature'));
+						reject(new InvalidSignatureError());
 					}
 				},
 			);

packages/crypto/src/utils/data-types.ts

@@ -102,3 +102,7 @@ export function encodeCanonicalJson(value: unknown): string {
 export function fromBase64ToBytes(base64: string): Uint8Array {
 	return Buffer.from(base64, 'base64');
 }
+
+export class InvalidSignatureError extends Error {
+	name = 'InvalidSignatureError';
+}

packages/crypto/src/utils/utils.spec.ts

@@ -1,5 +1,9 @@
 import { describe, expect, it } from 'bun:test';
-import { encodeCanonicalJson, fromBase64ToBytes } from './data-types';
+import {
+	InvalidSignatureError,
+	encodeCanonicalJson,
+	fromBase64ToBytes,
+} from './data-types';
 import {
 	loadEd25519SignerFromSeed,
 	loadEd25519VerifierFromPublicKey,
@@ -99,9 +103,63 @@ describe('Signing and verifying payloads', async () => {
 			'0',
 		);
 
-		expect(verifyJsonSignature({}, signature, verifier)).rejects.toThrowError(
-			'Invalid signature',
+		expect(verifyJsonSignature({}, signature, verifier)).rejects.toThrow(
+			InvalidSignatureError,
+		);
+	});
+
+	it('should validate signature (paranoid test 2)', async () => {
+		const event = {
+			auth_events: [
+				'$Hvb-xPPDhTvlXZe2kMubgj8J7iUa5W7YvjTqMTffgUA',
+				'$Ulggyo4m1OlI08Z0jJDVeceigjSZP9SdEFVoAn9mEh8',
+				'$G2TzsvetG2YlHr20tZLHCCzOd-yxPa1jeFT8OU4_6kg',
+				'$kXOAfDVvahrwzHEOInzmG941IeEJTn-qUOY0YnLIigs',
+			],
+			content: {
+				// displayname: 'debdut1',
+				membership: 'join' as const,
+			},
+			depth: 10,
+			hashes: { sha256: '6MnKSCFJy1fYf6ukILBEbqx2DkoaD1wRyKXhv689a0A' },
+			origin: 'syn1.tunnel.dev.rocket.chat',
+			origin_server_ts: 1757328411218,
+			prev_events: ['$kXOAfDVvahrwzHEOInzmG941IeEJTn-qUOY0YnLIigs'],
+			room_id: '!VoUasOLSpcdtRbGHdT:syn2.tunnel.dev.rocket.chat',
+			sender: '@debdut1:syn1.tunnel.dev.rocket.chat',
+			state_key: '@debdut1:syn1.tunnel.dev.rocket.chat',
+			type: 'm.room.member' as const,
+			signatures: {
+				'syn1.tunnel.dev.rocket.chat': {
+					'ed25519:a_FAET':
+						'eJlvqxPWPe3u+BM4wOwID9YBlh/ZfVVxGYyA5WgpNs5Fe1+c36qrvCKHuXGGjfQoZFrHmZ3/GJw2pv5EvxCZAA',
+				},
+			},
+			unsigned: {
+				age: 1,
+				replaces_state: '$kXOAfDVvahrwzHEOInzmG941IeEJTn-qUOY0YnLIigs',
+				prev_content: { displayname: 'debdut1', membership: 'invite' },
+				prev_sender: '@debdut:syn2.tunnel.dev.rocket.chat',
+			},
+		};
+
+		const { unsigned, signatures, ...rest } = event;
+
+		const key = 'kryovKVnhHESOdWuZ05ViNotRMVdEh/mG2yJ0npLzEo';
+
+		const verifier = await loadEd25519VerifierFromPublicKey(
+			fromBase64ToBytes(key),
+			'0',
 		);
+
+		const serialized = encodeCanonicalJson(rest);
+
+		const signature =
+			signatures['syn1.tunnel.dev.rocket.chat']['ed25519:a_FAET'];
+
+		const signatureBytes = fromBase64ToBytes(signature);
+
+		await verifier.verify(serialized, signatureBytes);
 	});
 });
 

packages/federation-sdk/src/__mocks__/block-if-no-mongo.ts

@@ -0,0 +1,8 @@
+export function runIfMongoExists(t: () => void) {
+	if (!process.env.RUN_MONGO_TESTS) {
+		console.warn('Skipping tests that require a database');
+		return;
+	}
+
+	t();
+}

packages/federation-sdk/src/__mocks__/repositories.spec.ts

@@ -0,0 +1,50 @@
+import {
+	EventStagingStore,
+	EventStore,
+	ServerKey,
+} from '@rocket.chat/federation-core';
+import { EventStagingRepository } from '../repositories/event-staging.repository';
+import { EventRepository } from '../repositories/event.repository';
+import { KeyRepository } from '../repositories/key.repository';
+import { Lock, LockRepository } from '../repositories/lock.repository';
+import {
+	StateGraphRepository,
+	type StateGraphStore,
+} from '../repositories/state-graph.repository';
+
+import { DatabaseConnectionService } from '../services/database-connection.service';
+
+const databaseConfig = {
+	uri: 'mongodb://localhost:27017/',
+	name: 'matrix_test',
+	poolSize: 100,
+};
+
+const database = new DatabaseConnectionService(databaseConfig);
+
+const db = await database.getDb();
+
+const keysCollection = db.collection<ServerKey>('test_keys');
+const eventsCollection = db.collection<EventStore>('test_events');
+const eventStagingCollection =
+	db.collection<EventStagingStore>('test_event_staging');
+const lockCollection = db.collection<Lock>('test_locks');
+const statesCollection = db.collection<StateGraphStore>('test_states');
+
+const keyRepository = new KeyRepository(keysCollection);
+
+const eventStagingRepository = new EventStagingRepository(
+	eventStagingCollection,
+);
+const lockRepository = new LockRepository(lockCollection);
+const stateRepository = new StateGraphRepository(statesCollection);
+
+const eventsRepository = new EventRepository(eventsCollection);
+
+export const repositories = {
+	keys: keyRepository,
+	locks: lockRepository,
+	eventStaging: eventStagingRepository,
+	states: stateRepository,
+	events: eventsRepository,
+};