atridad/signal_encryption_poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix
All checks were successful
Deploy Encrypted Todo App / build-and-push (push) Successful in 2m36s
Details

Browse Source
This commit is contained in:
Atridad Lahiji
2025-06-16 10:03:41 -06:00
parent a87a0bf6f8
commit 82b4892fda
4 changed files with 573 additions and 311 deletions
Download Patch File Download Diff File Expand all files Collapse all files

394
todo-service.js
View File

@ -1,18 +1,28 @@
import { DatabaseSync } from "node:sqlite";
import { createClient } from "@libsql/client";
import "dotenv/config";
import { SignalClient } from "./signal-crypto.js";
import { v4 as uuidv4 } from "uuid";
export class EncryptedTodoService {
constructor() {
this.db = new DatabaseSync(process.env.SQLITE_DB_PATH);
this.db = createClient({
url: `file:${process.env.SQLITE_DB_PATH}`,
});
this.users = new Map();
// Initialize database and migrate
this.initializeDatabase();
}
async initializeDatabase() {
// Create tables with new schema
this.db.exec(`
await this.db.execute(`
CREATE TABLE IF NOT EXISTS users (
userId TEXT PRIMARY KEY
);
`);
await this.db.execute(`
CREATE TABLE IF NOT EXISTS todos (
id TEXT PRIMARY KEY,
todoGroupId TEXT,
@ -25,12 +35,18 @@ export class EncryptedTodoService {
originalTodoId TEXT,
FOREIGN KEY(userId) REFERENCES users(userId)
);
`);
await this.db.execute(`
CREATE TABLE IF NOT EXISTS todo_groups (
todoGroupId TEXT PRIMARY KEY,
createdBy TEXT,
createdAt TEXT,
FOREIGN KEY(createdBy) REFERENCES users(userId)
);
`);
await this.db.execute(`
CREATE TABLE IF NOT EXISTS todo_participants (
todoGroupId TEXT,
userId TEXT,
@ -39,6 +55,9 @@ export class EncryptedTodoService {
FOREIGN KEY(todoGroupId) REFERENCES todo_groups(todoGroupId),
FOREIGN KEY(userId) REFERENCES users(userId)
);
`);
await this.db.execute(`
CREATE TABLE IF NOT EXISTS todo_shares (
todoId TEXT,
sharedWith TEXT,
@ -48,84 +67,90 @@ export class EncryptedTodoService {
`);
// Migrate existing data to new schema
this.migrateToNewSchema();
await this.migrateToNewSchema();
// Load existing users from database on startup
this.loadExistingUsers();
await this.loadExistingUsers();
}
migrateToNewSchema() {
async migrateToNewSchema() {
// Check if we need to migrate by looking for todos without todoGroupId
const oldTodos = this.db
.prepare("SELECT * FROM todos WHERE todoGroupId IS NULL")
.all();
const oldTodos = await this.db.execute(
"SELECT * FROM todos WHERE todoGroupId IS NULL",
);
if (oldTodos.length > 0) {
console.log(`Migrating ${oldTodos.length} todos to new schema...`);
if (oldTodos.rows.length > 0) {
console.log(`Migrating ${oldTodos.rows.length} todos to new schema...`);
for (const todo of oldTodos) {
for (const todo of oldTodos.rows) {
const todoGroupId = uuidv4();
const now = new Date().toISOString();
// If this is an original todo (not shared)
if (!todo.sharedBy && !todo.originalTodoId) {
// Create todo group
this.db
.prepare(
"INSERT OR IGNORE INTO todo_groups (todoGroupId, createdBy, createdAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, todo.userId, todo.createdAt || now);
await this.db.execute(
"INSERT OR IGNORE INTO todo_groups (todoGroupId, createdBy, createdAt) VALUES (?, ?, ?)",
[todoGroupId, todo.userId, todo.createdAt || now],
);
// Add creator as participant
this.db
.prepare(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, todo.userId, todo.createdAt || now);
await this.db.execute(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
[todoGroupId, todo.userId, todo.createdAt || now],
);
// Update the todo with todoGroupId
this.db
.prepare("UPDATE todos SET todoGroupId = ? WHERE id = ?")
.run(todoGroupId, todo.id);
await this.db.execute(
"UPDATE todos SET todoGroupId = ? WHERE id = ?",
[todoGroupId, todo.id],
);
// Find and migrate shared copies
const sharedCopies = this.db
.prepare("SELECT * FROM todos WHERE originalTodoId = ?")
.all(todo.id);
for (const sharedTodo of sharedCopies) {
const sharedCopies = await this.db.execute(
"SELECT * FROM todos WHERE originalTodoId = ?",
[todo.id],
);
for (const sharedTodo of sharedCopies.rows) {
// Add shared user as participant
this.db
.prepare(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, sharedTodo.userId, sharedTodo.createdAt || now);
await this.db.execute(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
[todoGroupId, sharedTodo.userId, sharedTodo.createdAt || now],
);
// Update shared todo with same todoGroupId
this.db
.prepare("UPDATE todos SET todoGroupId = ? WHERE id = ?")
.run(todoGroupId, sharedTodo.id);
await this.db.execute(
"UPDATE todos SET todoGroupId = ? WHERE id = ?",
[todoGroupId, sharedTodo.id],
);
}
}
// If this is a shared todo without a group (shouldn't happen after above, but just in case)
else if (todo.originalTodoId && !todo.todoGroupId) {
const originalTodo = this.db
.prepare("SELECT todoGroupId FROM todos WHERE id = ?")
.get(todo.originalTodoId);
if (originalTodo && originalTodo.todoGroupId) {
this.db
.prepare("UPDATE todos SET todoGroupId = ? WHERE id = ?")
.run(originalTodo.todoGroupId, todo.id);
const originalTodo = await this.db.execute(
"SELECT todoGroupId FROM todos WHERE id = ?",
[todo.originalTodoId],
);
if (
originalTodo.rows.length > 0 &&
originalTodo.rows[0].todoGroupId
) {
await this.db.execute(
"UPDATE todos SET todoGroupId = ? WHERE id = ?",
[originalTodo.rows[0].todoGroupId, todo.id],
);
// Add as participant if not already
this.db
.prepare(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
)
.run(
originalTodo.todoGroupId,
await this.db.execute(
"INSERT OR IGNORE INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
[
originalTodo.rows[0].todoGroupId,
todo.userId,
todo.createdAt || now,
);
],
);
}
}
}
@ -134,9 +159,9 @@ export class EncryptedTodoService {
}
}
loadExistingUsers() {
const existingUsers = this.db.prepare("SELECT userId FROM users").all();
for (const user of existingUsers) {
async loadExistingUsers() {
const existingUsers = await this.db.execute("SELECT userId FROM users");
for (const user of existingUsers.rows) {
if (!this.users.has(user.userId)) {
this.users.set(user.userId, SignalClient.create(user.userId));
console.log(`Loaded existing user: ${user.userId}`);
@ -144,24 +169,22 @@ export class EncryptedTodoService {
}
}
createUser(userId) {
this.db
.prepare("INSERT OR IGNORE INTO users (userId) VALUES (?)")
.run(userId);
async createUser(userId) {
await this.db.execute("INSERT OR IGNORE INTO users (userId) VALUES (?)", [
userId,
]);
if (!this.users.has(userId)) {
this.users.set(userId, SignalClient.create(userId));
}
return { userId };
}
getAllUsers() {
return this.db
.prepare("SELECT userId FROM users")
.all()
.map((u) => u.userId);
async getAllUsers() {
const result = await this.db.execute("SELECT userId FROM users");
return result.rows.map((u) => u.userId);
}
addTodo(userId, todoText) {
async addTodo(userId, todoText) {
const todoGroupId = uuidv4();
const client = this.users.get(userId);
const todoId = uuidv4();
@ -169,25 +192,21 @@ export class EncryptedTodoService {
const now = new Date().toISOString();
// Create the todo group
this.db
.prepare(
"INSERT INTO todo_groups (todoGroupId, createdBy, createdAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, userId, now);
await this.db.execute(
"INSERT INTO todo_groups (todoGroupId, createdBy, createdAt) VALUES (?, ?, ?)",
[todoGroupId, userId, now],
);
// Add the creator as a participant
this.db
.prepare(
"INSERT INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, userId, now);
await this.db.execute(
"INSERT INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
[todoGroupId, userId, now],
);
// Create the todo entry for the creator
this.db
.prepare(
"INSERT INTO todos (id, todoGroupId, userId, encrypted, createdAt, originalText, completed) VALUES (?, ?, ?, ?, ?, ?, ?)",
)
.run(
await this.db.execute(
"INSERT INTO todos (id, todoGroupId, userId, encrypted, createdAt, originalText, completed) VALUES (?, ?, ?, ?, ?, ?, ?)",
[
todoId,
todoGroupId,
userId,
@ -195,24 +214,25 @@ export class EncryptedTodoService {
now,
todoText,
0,
);
],
);
return todoGroupId;
}
getTodos(userId) {
async getTodos(userId) {
const client = this.users.get(userId);
if (!client) {
console.error(`No client found for user ${userId}`);
return [];
}
const rows = this.db
.prepare("SELECT * FROM todos WHERE userId = ?")
.all(userId);
const rows = await this.db.execute("SELECT * FROM todos WHERE userId = ?", [
userId,
]);
const todos = [];
for (const row of rows) {
for (const row of rows.rows) {
try {
// Skip todos without todoGroupId (migration didn't work)
if (!row.todoGroupId) {
@ -223,24 +243,28 @@ export class EncryptedTodoService {
const decryptedText = client.decrypt(JSON.parse(row.encrypted));
// Get all participants in this todo group
const participants = this.db
.prepare("SELECT userId FROM todo_participants WHERE todoGroupId = ?")
.all(row.todoGroupId)
.map((p) => p.userId);
const participants = await this.db.execute(
"SELECT userId FROM todo_participants WHERE todoGroupId = ?",
[row.todoGroupId],
);
// Get group creator
const groupInfo = this.db
.prepare("SELECT createdBy FROM todo_groups WHERE todoGroupId = ?")
.get(row.todoGroupId);
const groupInfo = await this.db.execute(
"SELECT createdBy FROM todo_groups WHERE todoGroupId = ?",
[row.todoGroupId],
);
todos.push({
id: row.todoGroupId, // Use todoGroupId as the primary identifier
text: decryptedText,
createdAt: row.createdAt,
completed: !!row.completed,
participants: participants.length > 0 ? participants : [userId], // Fallback to current user
createdBy: groupInfo?.createdBy || userId, // Fallback to current user
isCreator: (groupInfo?.createdBy || userId) === userId,
participants:
participants.rows.length > 0
? participants.rows.map((p) => p.userId)
: [userId], // Fallback to current user
createdBy: groupInfo.rows[0]?.createdBy || userId, // Fallback to current user
isCreator: (groupInfo.rows[0]?.createdBy || userId) === userId,
});
} catch (e) {
console.error(`Error processing todo ${row.id}:`, e);
@ -249,183 +273,197 @@ export class EncryptedTodoService {
return todos.sort((a, b) => new Date(b.createdAt) - new Date(a.createdAt));
}
getTodo(userId, todoGroupId) {
async getTodo(userId, todoGroupId) {
const client = this.users.get(userId);
const row = this.db
.prepare("SELECT * FROM todos WHERE todoGroupId = ? AND userId = ?")
.get(todoGroupId, userId);
if (!row) throw new Error("Todo not found");
const row = await this.db.execute(
"SELECT * FROM todos WHERE todoGroupId = ? AND userId = ?",
[todoGroupId, userId],
);
const decryptedText = client.decrypt(JSON.parse(row.encrypted));
if (row.rows.length === 0) throw new Error("Todo not found");
const todoRow = row.rows[0];
const decryptedText = client.decrypt(JSON.parse(todoRow.encrypted));
// Get all participants in this todo group
const participants = this.db
.prepare("SELECT userId FROM todo_participants WHERE todoGroupId = ?")
.all(todoGroupId)
.map((p) => p.userId);
const participants = await this.db.execute(
"SELECT userId FROM todo_participants WHERE todoGroupId = ?",
[todoGroupId],
);
// Get group creator
const groupInfo = this.db
.prepare("SELECT createdBy FROM todo_groups WHERE todoGroupId = ?")
.get(todoGroupId);
const groupInfo = await this.db.execute(
"SELECT createdBy FROM todo_groups WHERE todoGroupId = ?",
[todoGroupId],
);
return {
id: todoGroupId,
text: decryptedText,
createdAt: row.createdAt,
completed: !!row.completed,
participants: participants,
createdBy: groupInfo?.createdBy,
isCreator: groupInfo?.createdBy === userId,
createdAt: todoRow.createdAt,
completed: !!todoRow.completed,
participants: participants.rows.map((p) => p.userId),
createdBy: groupInfo.rows[0]?.createdBy,
isCreator: groupInfo.rows[0]?.createdBy === userId,
};
}
updateTodoStatus(userId, todoGroupId, completed) {
async updateTodoStatus(userId, todoGroupId, completed) {
console.log(
`updateTodoStatus called: userId=${userId}, todoGroupId=${todoGroupId}, completed=${completed}`,
);
// Get all participants in this todo group
const participants = this.db
.prepare("SELECT userId FROM todo_participants WHERE todoGroupId = ?")
.all(todoGroupId)
.map((p) => p.userId);
const participants = await this.db.execute(
"SELECT userId FROM todo_participants WHERE todoGroupId = ?",
[todoGroupId],
);
if (!participants.includes(userId)) {
const participantIds = participants.rows.map((p) => p.userId);
if (!participantIds.includes(userId)) {
throw new Error("User is not a participant in this todo group");
}
console.log(`Updating todo for all participants:`, participants);
console.log(`Updating todo for all participants:`, participantIds);
// Update todos for all participants
for (const participantId of participants) {
this.db
.prepare(
"UPDATE todos SET completed = ? WHERE todoGroupId = ? AND userId = ?",
)
.run(completed ? 1 : 0, todoGroupId, participantId);
for (const participantId of participantIds) {
await this.db.execute(
"UPDATE todos SET completed = ? WHERE todoGroupId = ? AND userId = ?",
[completed ? 1 : 0, todoGroupId, participantId],
);
}
console.log(`Affected users for todo update:`, participants);
return participants;
console.log(`Affected users for todo update:`, participantIds);
return participantIds;
}
deleteTodo(userId, todoGroupId) {
async deleteTodo(userId, todoGroupId) {
// Get all participants in this todo group
const participants = this.db
.prepare("SELECT userId FROM todo_participants WHERE todoGroupId = ?")
.all(todoGroupId)
.map((p) => p.userId);
const participants = await this.db.execute(
"SELECT userId FROM todo_participants WHERE todoGroupId = ?",
[todoGroupId],
);
if (!participants.includes(userId)) {
const participantIds = participants.rows.map((p) => p.userId);
if (!participantIds.includes(userId)) {
throw new Error("User is not a participant in this todo group");
}
// Check if user is the creator of this todo group
const groupInfo = this.db
.prepare("SELECT createdBy FROM todo_groups WHERE todoGroupId = ?")
.get(todoGroupId);
const groupInfo = await this.db.execute(
"SELECT createdBy FROM todo_groups WHERE todoGroupId = ?",
[todoGroupId],
);
if (!groupInfo) {
if (groupInfo.rows.length === 0) {
throw new Error("Todo group not found");
}
if (groupInfo.createdBy !== userId) {
if (groupInfo.rows[0].createdBy !== userId) {
throw new Error("Only the creator can delete this todo");
}
console.log(
`Deleting todo group ${todoGroupId} for all participants:`,
participants,
participantIds,
);
// Delete all todo entries for this group
this.db.prepare("DELETE FROM todos WHERE todoGroupId = ?").run(todoGroupId);
await this.db.execute("DELETE FROM todos WHERE todoGroupId = ?", [
todoGroupId,
]);
// Delete all participants
this.db
.prepare("DELETE FROM todo_participants WHERE todoGroupId = ?")
.run(todoGroupId);
await this.db.execute(
"DELETE FROM todo_participants WHERE todoGroupId = ?",
[todoGroupId],
);
// Delete the group itself
this.db
.prepare("DELETE FROM todo_groups WHERE todoGroupId = ?")
.run(todoGroupId);
await this.db.execute("DELETE FROM todo_groups WHERE todoGroupId = ?", [
todoGroupId,
]);
return {
deletedIds: [todoGroupId],
affectedUsers: participants,
affectedUsers: participantIds,
};
}
shareTodo(userId, todoGroupId, recipientId) {
async shareTodo(userId, todoGroupId, recipientId) {
// Ensure recipient user exists
if (!this.users.has(recipientId)) {
this.users.set(recipientId, SignalClient.create(recipientId));
}
// Check if user is a participant in this todo group
const participants = this.db
.prepare("SELECT userId FROM todo_participants WHERE todoGroupId = ?")
.all(todoGroupId)
.map((p) => p.userId);
const participants = await this.db.execute(
"SELECT userId FROM todo_participants WHERE todoGroupId = ?",
[todoGroupId],
);
if (!participants.includes(userId)) {
const participantIds = participants.rows.map((p) => p.userId);
if (!participantIds.includes(userId)) {
throw new Error("User is not a participant in this todo group");
}
// Check if user is the creator of this todo group
const groupInfo = this.db
.prepare("SELECT createdBy FROM todo_groups WHERE todoGroupId = ?")
.get(todoGroupId);
const groupInfo = await this.db.execute(
"SELECT createdBy FROM todo_groups WHERE todoGroupId = ?",
[todoGroupId],
);
if (!groupInfo) {
if (groupInfo.rows.length === 0) {
throw new Error("Todo group not found");
}
if (groupInfo.createdBy !== userId) {
if (groupInfo.rows[0].createdBy !== userId) {
throw new Error("Only the creator can add participants to this todo");
}
if (participants.includes(recipientId)) {
if (participantIds.includes(recipientId)) {
throw new Error("User is already a participant in this todo group");
}
// Get the original text from the sender's todo
const senderTodo = this.db
.prepare("SELECT * FROM todos WHERE todoGroupId = ? AND userId = ?")
.get(todoGroupId, userId);
const senderTodo = await this.db.execute(
"SELECT * FROM todos WHERE todoGroupId = ? AND userId = ?",
[todoGroupId, userId],
);
if (!senderTodo) throw new Error("Todo not found");
if (senderTodo.rows.length === 0) throw new Error("Todo not found");
const senderTodoRow = senderTodo.rows[0];
const recipientClient = this.users.get(recipientId);
const encryptedForRecipient = recipientClient.encrypt(
senderTodo.originalText,
senderTodoRow.originalText,
);
const recipientTodoId = uuidv4();
const now = new Date().toISOString();
// Add recipient as a participant
this.db
.prepare(
"INSERT INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
)
.run(todoGroupId, recipientId, now);
await this.db.execute(
"INSERT INTO todo_participants (todoGroupId, userId, joinedAt) VALUES (?, ?, ?)",
[todoGroupId, recipientId, now],
);
// Create todo entry for the recipient
this.db
.prepare(
"INSERT INTO todos (id, todoGroupId, userId, encrypted, createdAt, originalText, completed) VALUES (?, ?, ?, ?, ?, ?, ?)",
)
.run(
await this.db.execute(
"INSERT INTO todos (id, todoGroupId, userId, encrypted, createdAt, originalText, completed) VALUES (?, ?, ?, ?, ?, ?, ?)",
[
recipientTodoId,
todoGroupId,
recipientId,
JSON.stringify(encryptedForRecipient),
now,
senderTodo.originalText,
senderTodo.completed,
);
senderTodoRow.originalText,
senderTodoRow.completed,
],
);
return todoGroupId;
}