randogoth/gsmol
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: auto-verify signed Reply-To on fetch; seal the export to the identity

Browse source
This commit is contained in:
randogoth 2026-09-26 22:14:40 +03:00
parent 1385ecb56c
commit eef7bf9b1d
2 changed files with 99 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

66
web/js/app.js
View file

@ -445,7 +445,9 @@ async function openMessage(id) {
`this message carries the sender's signed address: ${opened.replyAddress.short}`));
actions.append(el("button", { type: "button", textContent: "save sender & reply", onclick: () => {
try {
saveReplyAddress(opened.replyAddress, opened.sender);
bindReplyAddress(opened.replyAddress, opened.sender);
status(`${opened.replyAddress.short} saved for this sender (verified key)`);
renderFolder();
openMessage(row.id);
startReply(row);
} catch (err) {
@ -529,17 +531,18 @@ async function nameSender(text, senderKey) {
renderFolder();
}
// A signed Reply-To is the sender's own claim, so it saves as verified — but
// never over an address already pinned to a different key (§8: a key change
// without a rotation chain needs out-of-band confirmation).
function saveReplyAddress(addr, senderKey) {
// A signed Reply-To is the sender's own claim, verified the moment unseal()
// verified the message's signature — no further trust step to gate behind a
// click. Never overwrites an address already pinned to a different key (§8:
// a key change without a rotation chain needs out-of-band confirmation). No
// UI side effects: callers (the reader's button, fetch's auto-bind) decide
// how to report the result and whether many need batching into one summary.
function bindReplyAddress(addr, senderKey) {
const existing = store.contact(addr.short);
if (existing && !timingSafeEqual(existing.key, senderKey))
throw new SmolError(`${addr.short} is already known with a different key — ` +
`verify out of band before replying`);
store.saveContact(addr.short, senderKey, true);
status(`${addr.short} saved for this sender (verified key)`);
renderFolder();
}
// --- compose and send -----------------------------------------------------------
@ -642,7 +645,7 @@ $("fetch").onclick = async () => {
button.disabled = true; // one session at a time; the icon spins while it is
label.textContent = "fetching…";
status("fetching…");
let stored = 0;
let stored = 0, verified = 0;
const rejected = [];
try {
const opened = await connect(addr, { requirePin: true });
@ -653,10 +656,11 @@ $("fetch").onclick = async () => {
if (!records.length) break;
const acked = [];
for (const record of records) {
let unsealed;
try {
if (!timingSafeEqual(messageId(record.envelope), record.id))
throw new SmolError("id does not match the envelope");
unseal(store.identities(), record.envelope);
unsealed = unseal(store.identities(), record.envelope);
} catch (err) {
// Left on the server rather than destroyed, so a client-side bug
// cannot lose mail. Collected rather than announced, because the
@ -664,9 +668,21 @@ $("fetch").onclick = async () => {
rejected.push(`${hex(record.id)}: ${err.message}`);
continue;
}
if (await store.storeIfNew("inbox", {
id: hex(record.id), envelope: record.envelope, receivedAt: record.receivedAt,
})) stored++;
const row = { id: hex(record.id), envelope: record.envelope, receivedAt: record.receivedAt };
if (await store.storeIfNew("inbox", row)) {
stored++;
// A signed Reply-To is exactly as verified as the signature
// unseal() just checked — see bindReplyAddress(). describe()
// both parses the same claim the reader would show and warms its
// cache, so opening the message right after costs nothing extra.
const claim = describe(row).replyAddress;
if (claim) {
try {
bindReplyAddress(claim, unsealed.sender);
verified++;
} catch { /* already known under a different key: leave it be */ }
}
}
acked.push(record.id);
}
if (!acked.length) break;
@ -675,7 +691,9 @@ $("fetch").onclick = async () => {
} finally {
opened.session.stream.close();
}
status([`${stored} new, ${rejected.length} rejected`, ...rejected.map(line => ` ${line}`),
status([`${stored} new, ${rejected.length} rejected`,
verified ? `${verified} sender${verified === 1 ? "" : "s"} verified from a signed Reply-To` : null,
...rejected.map(line => ` ${line}`),
rejected.length ? "left on the server" : null].filter(Boolean).join("\n"),
rejected.length > 0);
} catch (err) {
@ -989,14 +1007,20 @@ $("recall-form").onsubmit = async (event) => {
};
$("export-data").onclick = async () => {
const data = await store.exportData();
const blob = new Blob([JSON.stringify(data)], { type: "application/json" });
const url = URL.createObjectURL(blob);
const stamp = new Date(data.exportedAt).toISOString().slice(0, 10);
Object.assign(document.createElement("a"), { href: url, download: `gsmol-export-${stamp}.json` }).click();
URL.revokeObjectURL(url);
status(`exported ${data.inbox.length + data.sent.length} messages, ` +
`${Object.keys(data.contacts).length} contacts, ${Object.keys(data.servers).length} server keys`);
try {
const data = await store.exportData();
const blob = new Blob([JSON.stringify(data)], { type: "application/json" });
const url = URL.createObjectURL(blob);
const stamp = new Date(data.exportedAt).toISOString().slice(0, 10);
Object.assign(document.createElement("a"), { href: url, download: `gsmol-export-${stamp}.json` }).click();
URL.revokeObjectURL(url);
// No counts in the message: the file itself is sealed precisely so an
// observer learns nothing from it, and a summary here would just move
// that same leak from the file to the screen right next to it.
status("exported — sealed to this identity; only a browser with this seed restored can open it");
} catch (err) {
status(err.message, true);
}
};
$("import-data-trigger").onclick = () => $("import-data").click();

68
web/js/store.js
View file

@ -2,7 +2,7 @@
// sealed envelopes in IndexedDB, opened only on demand, so nothing at rest
// is plaintext (the seed excepted — it is the user's browser profile).
import { hex, unhex } from "./crypto.js";
import { aeadDecrypt, aeadEncrypt, hex, hkdfSha256, randomBytes, unhex, utf8Bytes } from "./crypto.js";
import { b32decode, b32encode, identityFromSeed } from "./proto.js";
const KEY = "gsmol";
@ -243,16 +243,27 @@ export async function unreadCount() {
const toBase64 = (bytes) => btoa(String.fromCharCode(...bytes));
const fromBase64 = (text) => Uint8Array.from(atob(text), c => c.charCodeAt(0));
// A gsmol-only construction, not the wire protocol's own HKDF namespace
// ("smolmail/1 ..." in proto.js) — export/import has no counterpart in
// SPEC.md, so it gets its own label rather than borrowing the protocol's.
// Sealing to a key derived from the identity's own seed means the file is
// opaque without it — no new passphrase to manage, and it can only ever be
// opened where that seed is already restored, exactly the situation import
// already assumes.
const EXPORT_LABEL = utf8Bytes("gsmol/1 export");
const exportKey = (seed) => hkdfSha256(seed, new Uint8Array(0), EXPORT_LABEL, 32);
// Deliberately excludes the seed: it already has its own reveal-and-copy flow
// in settings, meant for a password manager, not a downloadable file. This
// covers what fetching makes irreplaceable (SPEC.md §5 deletes mail from the
// server once acknowledged) plus the trust state that took real verification
// (RESOLVE, key comparison) to build up — pins and contacts.
// in settings, meant for a password manager, not a downloadable file. Beyond
// that, everything else in here was worth hiding too — contacts and pins are
// a social graph and a list of which mail servers you use, not just the mail
// SPEC.md §5 makes irreplaceable once fetched — so the whole payload is
// sealed, not just the parts that were already ciphertext at rest.
export async function exportData() {
const me = identity();
if (!me) throw new Error("no identity yet");
const [inbox, sent] = await Promise.all([listMessages("inbox"), listMessages("sent")]);
return {
gsmolExport: 1,
exportedAt: Date.now(),
const payload = {
servers: Object.fromEntries(allPins().map(({ host, key }) => [host, key])),
contacts: Object.fromEntries(allContacts().map(({ address, key, verified, history }) =>
[address, { key, verified, history }])),
@ -260,6 +271,19 @@ export async function exportData() {
sent: sent.map(row =>
({ id: row.id, recipient: row.recipient, sentAt: row.sentAt, envelope: toBase64(row.envelope) })),
};
// Random per export: the key is the same every time (deterministic from the
// seed), so nonce reuse has to be ruled out the way it always is under a
// fixed key — a fresh 96-bit nonce per seal, not a fixed one like seal()'s
// in proto.js gets away with (there, a fresh ephemeral key each message
// makes the derived key itself unique, so a zero nonce is safe).
const nonce = randomBytes(12);
const ciphertext = aeadEncrypt(exportKey(me.seed), nonce, utf8Bytes(JSON.stringify(payload)), new Uint8Array(0));
return {
gsmolExport: 2,
exportedAt: Date.now(),
nonce: toBase64(nonce),
ciphertext: toBase64(ciphertext),
};
}
// Never overwrites a trust binding that already differs locally — the same
@ -274,14 +298,30 @@ export async function exportData() {
const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
export async function importData(data) {
if (!data || data.gsmolExport !== 1) throw new Error("not a gsmol export file");
let payload;
if (data?.gsmolExport === 2) {
const me = identity();
if (!me) throw new Error("no identity yet — restore it before importing");
try {
const plaintext = aeadDecrypt(
exportKey(me.seed), fromBase64(data.nonce), fromBase64(data.ciphertext), new Uint8Array(0));
payload = JSON.parse(new TextDecoder().decode(plaintext));
} catch {
throw new Error("couldn't decrypt — exported by a different identity, or the file is corrupted");
}
} else if (data?.gsmolExport === 1) {
payload = data; // pre-encryption shape: the fields already sit at the top level
} else {
throw new Error("not a gsmol export file");
}
const summary = { pinsAdded: 0, pinsConflicted: 0, contactsAdded: 0, contactsConflicted: 0,
mailAdded: 0, malformed: 0 };
update(state => {
const servers = { ...(state.servers || {}) };
if (data.servers !== undefined && !isRecord(data.servers)) summary.malformed++;
for (const [host, key] of Object.entries(isRecord(data.servers) ? data.servers : {})) {
if (payload.servers !== undefined && !isRecord(payload.servers)) summary.malformed++;
for (const [host, key] of Object.entries(isRecord(payload.servers) ? payload.servers : {})) {
try {
if (b32decode(key).length !== 32) throw new Error("bad length");
} catch { summary.malformed++; continue; }
@ -291,8 +331,8 @@ export async function importData(data) {
state.servers = servers;
const contacts = { ...(state.contacts || {}) };
if (data.contacts !== undefined && !isRecord(data.contacts)) summary.malformed++;
for (const [address, c] of Object.entries(isRecord(data.contacts) ? data.contacts : {})) {
if (payload.contacts !== undefined && !isRecord(payload.contacts)) summary.malformed++;
for (const [address, c] of Object.entries(isRecord(payload.contacts) ? payload.contacts : {})) {
try {
if (typeof c.key !== "string" || b32decode(c.key).length !== 32) throw new Error("bad key");
} catch { summary.malformed++; continue; }
@ -307,7 +347,7 @@ export async function importData(data) {
state.contacts = contacts;
});
for (const [box, rows] of [["inbox", data.inbox], ["sent", data.sent]]) {
for (const [box, rows] of [["inbox", payload.inbox], ["sent", payload.sent]]) {
if (rows !== undefined && !Array.isArray(rows)) summary.malformed++;
for (const row of Array.isArray(rows) ? rows : []) {
try {