malice

public

Star0

Fork 0

Watch0

103 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `4929dcd34937`

tarball

atagen <boss@atagen.co>2026-10-26 04:43 UTC

9 files changed+282-4

web: protect encrypted storage and expose key backup controls

An iOS Home Screen install gets storage separate from Safari, so a device-build install is a new E2EE device whose keys die with that storage. The client now requests persistent storage and warns when it's refused, and Security can enable or turn off an existing backup. create_key_backup has no UI because it replaces any server-side backup under a new key, so recovery setup waits on macltok's enable_recovery.

Modified file: crates/malice-core/src/request.rs+44 additions@@ -244,6 +244,15 @@ pub enum Request {
     Recover {
         recovery_key: String,
     },
+    CreateKeyBackup,
+    EnableKeyBackup,
+    DisableKeyBackup {
+        #[serde(default)]
+        delete_from_server: bool,
+    },
+    RecoverKeyBackup {
+        recovery_key: String,
+    },
     StartVerification,
     Verify {
         action: String,
@@ -925,6 +934,25 @@ pub async fn dispatch(
             handle.recover(recovery_key).await?;
             Ok(Reply::Done)
         }
+        Request::CreateKeyBackup => {
+            handle.create_key_backup().await?;
+            Ok(Reply::Done)
+        }
+        Request::EnableKeyBackup => {
+            handle.enable_key_backup().await?;
+            Ok(Reply::Done)
+        }
+        Request::DisableKeyBackup { delete_from_server } => {
+            handle.disable_key_backup(delete_from_server).await?;
+            Ok(Reply::Done)
+        }
+        Request::RecoverKeyBackup { recovery_key } => {
+            if recovery_key.trim().is_empty() {
+                return Err(CoreError::bad_request("recovery_key is required"));
+            }
+            handle.recover_key_backup(recovery_key).await?;
+            Ok(Reply::Done)
+        }
         Request::StartVerification => {
             handle
                 .start_verification(VerificationTarget::OwnIdentity)
@@ -1480,6 +1508,22 @@ mod tests {
     }
 
     #[test]
+    fn key_backup_requests_parse() {
+        let create: Request = serde_json::from_str(r#"{"op":"create_key_backup"}"#).unwrap();
+        assert!(matches!(create, Request::CreateKeyBackup));
+        let disable: Request = serde_json::from_str(r#"{"op":"disable_key_backup"}"#).unwrap();
+        assert!(matches!(
+            disable,
+            Request::DisableKeyBackup {
+                delete_from_server: false
+            }
+        ));
+        let recover: Request =
+            serde_json::from_str(r#"{"op":"recover_key_backup","recovery_key":"k"}"#).unwrap();
+        assert!(matches!(recover, Request::RecoverKeyBackup { .. }));
+    }
+
+    #[test]
     fn reaction_keys() {
         assert!(valid_reaction_key("👍"));
         assert!(!valid_reaction_key(""));

Modified file: crates/malice-server/src/routes.rs+4 additions@@ -566,6 +566,10 @@ async fn post_command(
             | Request::SetMentionsRead { .. }
             | Request::MarkMentionsReadThrough { .. }
             | Request::RecoverMentions
+            | Request::CreateKeyBackup
+            | Request::EnableKeyBackup
+            | Request::DisableKeyBackup { .. }
+            | Request::RecoverKeyBackup { .. }
             | Request::RetryRecentHistory { .. }
             | Request::EventContext { .. }
             | Request::EventContextBefore { .. }

Modified file: web/src/lib/SecurityPanel.svelte+56 additions−4 deletions@@ -1,8 +1,10 @@
 <script lang="ts">
-  import { createEventDispatcher } from 'svelte';
+  import { createEventDispatcher, onMount } from 'svelte';
   import {
     recoverEncryption,
+    runKeyBackup,
     startVerification,
+    type KeyBackupAction,
     verifyEncryption,
     type VerifyAction
   } from './api';
@@ -20,7 +22,28 @@
   export let onEncryptedPreviews: (enabled: boolean) => void = () => undefined;
 
   let recoveryKey = '';
-  let busy: VerifyAction | 'recover' | 'start' | null = null;
+  let recoveryInput: HTMLInputElement | undefined;
+
+  onMount(() => {
+    if (encryptionState && encryptionState.recovery !== 'Enabled') recoveryInput?.focus();
+  });
+  let busy: VerifyAction | KeyBackupAction | 'recover' | 'start' | null = null;
+
+  let confirmOff = false;
+
+  async function backup(op: KeyBackupAction, deleteFromServer = false): Promise<void> {
+    if (busy) return;
+    busy = op;
+    try {
+      await runKeyBackup(op, deleteFromServer);
+      confirmOff = false;
+      onAction();
+    } catch (e) {
+      pushBanner(e instanceof Error ? e.message : 'Key backup failed');
+    } finally {
+      busy = null;
+    }
+  }
 
 
   function verificationTitle(state: VerificationState): string {
@@ -104,6 +127,33 @@
     {/if}
   </section>
 
+  <section aria-label="Key backup">
+    <h3 class="sec-h">Key backup</h3>
+    {#if encryptionState?.key_backup === 'Enabled'}
+      <p class="sec-line"><span class="pill ok">on</span></p>
+      <div class="row">
+        {#if confirmOff}
+          <button type="button" class="ghost-btn danger" disabled={busy !== null} on:click={() => void backup('disable_key_backup')}>
+            {busy === 'disable_key_backup' ? 'Turning off…' : 'Turn off'}
+          </button>
+          <button type="button" class="ghost-btn danger" disabled={busy !== null} on:click={() => void backup('disable_key_backup', true)}>
+            Turn off and delete from server
+          </button>
+          <button type="button" class="ghost-btn" disabled={busy !== null} on:click={() => (confirmOff = false)}>Cancel</button>
+        {:else}
+          <button type="button" class="ghost-btn danger" on:click={() => (confirmOff = true)}>Turn off</button>
+        {/if}
+      </div>
+    {:else if encryptionState}
+      <p class="sec-line"><span class="pill warn">{encryptionState.key_backup === 'Disabled' ? 'off' : encryptionState.key_backup.toLowerCase()}</span></p>
+      <div class="row">
+        <button type="button" class="primary-btn" disabled={busy !== null} on:click={() => void backup('enable_key_backup')}>
+          {busy === 'enable_key_backup' ? 'Turning on…' : 'Use existing backup'}
+        </button>
+      </div>
+    {/if}
+  </section>
+
   <section aria-label="Recovery">
     <h3 class="sec-h">Recovery</h3>
     <form on:submit|preventDefault={recover}>
@@ -115,6 +165,7 @@
           spellcheck="false"
           placeholder="EsT4 …"
           bind:value={recoveryKey}
+          bind:this={recoveryInput}
           disabled={busy !== null}
         />
       </label>
@@ -209,8 +260,9 @@
 </div>
 
 <style>
-  .sec-h { font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); margin: 16px 0 6px; }
-  .sec-h:first-child { margin-top: 0; }
+  .sec-h { font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); margin: 0 0 6px; }
+  section + section { margin-top: 20px; }
+  .primary-btn.wide { margin-top: 8px; }
   .sec-line { font-size: 13px; margin: 0 0 8px; overflow-wrap: anywhere; }
   .sec-line.muted, .sec-note { color: var(--muted); font-size: 12.5px; }
   .sec-note { margin: 8px 0 0; }

Added file: web/src/lib/StorageBanner.svelte+15 additions@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { createEventDispatcher } from 'svelte';
+  import { dismissStorageWarning, storageUnprotected } from './protection';
+  import { sessionUser } from './store';
+
+  const dispatch = createEventDispatcher<{ open: void }>();
+</script>
+
+{#if $storageUnprotected}
+  <div class="sec-banner warn" role="status">
+    <span>Browser storage can be cleared</span>
+    <button type="button" on:click={() => dispatch('open')}>Back up</button>
+    <button type="button" aria-label="Dismiss" on:click={() => $sessionUser && dismissStorageWarning($sessionUser)}>✕</button>
+  </div>
+{/if}

Modified file: web/src/lib/api.ts+6 additions@@ -161,6 +161,12 @@ export function recoverEncryption(recovery_key: string): Promise<void> {
   return transport.recoverEncryption(recovery_key);
 }
 
+export type KeyBackupAction = 'enable_key_backup' | 'disable_key_backup';
+
+export async function runKeyBackup(op: KeyBackupAction, deleteFromServer = false): Promise<void> {
+  await transport.command(op === 'disable_key_backup' ? { op, delete_from_server: deleteFromServer } : { op });
+}
+
 export function startVerification(): Promise<void> {
   return transport.startVerification();
 }

Added file: web/src/lib/protection-model.ts+64 additions@@ -0,0 +1,64 @@
+import type { EncryptionState } from './types';
+
+export type RecoveryPrompt = 'recover' | 'setup';
+
+export interface InstallContext {
+  device: boolean;
+  standalone: boolean;
+}
+
+export interface PersistResult {
+  persisted: boolean;
+  usage: number | null;
+  quota: number | null;
+}
+
+export interface StorageLike {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+}
+
+export interface PersistManager {
+  persisted?(): Promise<boolean>;
+  persist?(): Promise<boolean>;
+  estimate?(): Promise<{ usage?: number; quota?: number }>;
+}
+
+export function canDismissRecovery(ctx: InstallContext): boolean {
+  return ctx.device && !ctx.standalone;
+}
+
+export function recoveryPrompt(state: EncryptionState | null, ctx: InstallContext, dismissed: boolean): RecoveryPrompt | null {
+  if (!state) return null;
+  if (state.recovery === 'Incomplete') return 'recover';
+  if (state.recovery === 'Disabled') return dismissed && canDismissRecovery(ctx) ? null : 'setup';
+  return null;
+}
+
+export function dismissalKey(kind: 'recovery' | 'storage', account: string): string {
+  return `malice.dismissed.${kind}.${account}`;
+}
+
+export function isDismissed(store: StorageLike, kind: 'recovery' | 'storage', account: string): boolean {
+  try {
+    return store.getItem(dismissalKey(kind, account)) === '1';
+  } catch {
+    return false;
+  }
+}
+
+export function setDismissed(store: StorageLike, kind: 'recovery' | 'storage', account: string): void {
+  try {
+    store.setItem(dismissalKey(kind, account), '1');
+  } catch {
+    // dismissal then lasts only for this page load
+  }
+}
+
+export async function requestPersistence(manager: PersistManager | undefined): Promise<PersistResult | null> {
+  if (!manager?.persist || !manager.persisted) return null;
+  let persisted = await manager.persisted();
+  if (!persisted) persisted = await manager.persist();
+  const estimate = manager.estimate ? await manager.estimate().catch(() => null) : null;
+  return { persisted, usage: estimate?.usage ?? null, quota: estimate?.quota ?? null };
+}

Added file: web/src/lib/protection.ts+38 additions@@ -0,0 +1,38 @@
+import { writable } from 'svelte/store';
+import {
+  isDismissed,
+  requestPersistence,
+  setDismissed,
+  type InstallContext
+} from './protection-model';
+
+export const storageUnprotected = writable(false);
+export const recoveryDismissed = writable(false);
+
+export const isDeviceBuild = import.meta.env.VITE_MALICE_TARGET === 'device';
+
+export function installContext(): InstallContext {
+  const standalone =
+    window.matchMedia('(display-mode: standalone)').matches ||
+    (navigator as Navigator & { standalone?: boolean }).standalone === true;
+  return { device: isDeviceBuild, standalone };
+}
+
+export function loadDismissals(account: string): void {
+  recoveryDismissed.set(isDismissed(localStorage, 'recovery', account));
+}
+
+export async function protectStorage(account: string): Promise<void> {
+  const result = await requestPersistence(navigator.storage).catch(() => null);
+  storageUnprotected.set(isDeviceBuild && result !== null && !result.persisted && !isDismissed(localStorage, 'storage', account));
+}
+
+export function dismissStorageWarning(account: string): void {
+  setDismissed(localStorage, 'storage', account);
+  storageUnprotected.set(false);
+}
+
+export function dismissRecoveryPrompt(account: string): void {
+  setDismissed(localStorage, 'recovery', account);
+  recoveryDismissed.set(true);
+}

Modified file: web/src/lib/transport.ts+3 additions@@ -37,6 +37,9 @@ export type CommandRequest =
   | { op: 'set_room_avatar'; room_id: string; mxc: string | null }
   | { op: 'mute'; room_id: string; user_id: string; muted: boolean }
   | { op: 'notification_keywords' }
+  | { op: 'create_key_backup' | 'enable_key_backup' }
+  | { op: 'disable_key_backup'; delete_from_server?: boolean }
+  | { op: 'recover_key_backup'; recovery_key: string }
   | { op: 'search'; query: string; scope: unknown; limit: number }
   | { op: 'search_more'; search_id: string; cursor: string; limit: number }
   | { op: 'close_search'; search_id: string }

Added file: web/test/protection.test.ts+52 additions@@ -0,0 +1,52 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { isDismissed, recoveryPrompt, requestPersistence, setDismissed } from '../src/lib/protection-model.ts';
+
+const state = (recovery: 'Unknown' | 'Disabled' | 'Incomplete' | 'Enabled') => ({
+  device_id: 'D',
+  device_verified: true,
+  recovery,
+  key_backup: 'Disabled'
+});
+
+const browser = { device: false, standalone: false };
+const device = { device: true, standalone: false };
+const installed = { device: true, standalone: true };
+
+test('recovery prompt follows recovery state', () => {
+  assert.equal(recoveryPrompt(null, device, false), null);
+  assert.equal(recoveryPrompt(state('Unknown'), device, false), null);
+  assert.equal(recoveryPrompt(state('Enabled'), device, false), null);
+  assert.equal(recoveryPrompt(state('Incomplete'), device, true), 'recover');
+  assert.equal(recoveryPrompt(state('Disabled'), device, false), 'setup');
+});
+
+test('only the device build in a browser tab may dismiss the setup prompt', () => {
+  assert.equal(recoveryPrompt(state('Disabled'), device, true), null);
+  assert.equal(recoveryPrompt(state('Disabled'), installed, true), 'setup');
+  assert.equal(recoveryPrompt(state('Disabled'), browser, true), 'setup');
+});
+
+test('dismissals are per account', () => {
+  const data = new Map<string, string>();
+  const store = { getItem: (k: string) => data.get(k) ?? null, setItem: (k: string, v: string) => void data.set(k, v) };
+  setDismissed(store, 'storage', '@a:x');
+  assert.equal(isDismissed(store, 'storage', '@a:x'), true);
+  assert.equal(isDismissed(store, 'storage', '@b:x'), false);
+  assert.equal(isDismissed(store, 'recovery', '@a:x'), false);
+});
+
+test('persistence is requested only when not already granted', async () => {
+  let asked = 0;
+  const denied = {
+    persisted: async () => false,
+    persist: async () => (asked++, false),
+    estimate: async () => ({ usage: 5, quota: 100 })
+  };
+  assert.deepEqual(await requestPersistence(denied), { persisted: false, usage: 5, quota: 100 });
+  assert.equal(asked, 1);
+  const granted = { persisted: async () => true, persist: async () => (asked++, true) };
+  assert.deepEqual(await requestPersistence(granted), { persisted: true, usage: null, quota: null });
+  assert.equal(asked, 1);
+  assert.equal(await requestPersistence(undefined), null);
+});

malice

Commit 4929dcd34937

Commit `4929dcd34937`