Christian Nennemann
553de3a2b7
REPL auto-setup (zero-friction startup): - OnceLock → RwLock for CLIENT_AUTH to allow delayed init after OPAQUE login - Extract opaque_register/opaque_login helpers from one-shot commands - Token cache (.session file) with QPCE encryption when password provided - Add --username/--password/--state-password to repl subcommand - resolve_access_token: auto-register + login, cache token, prompt interactively - rpassword for secure password input (no echo) Interactive REPL (multi-conversation): - SessionState: identity, hybrid key, ConversationStore, per-conversation GroupMembers - ConversationStore: SQLite-backed conversations + messages with full CRUD - Slash commands: /dm, /group, /invite, /join, /switch, /list, /members, /history, /whoami - Background polling (1s interval) with auto-join from MLS Welcome messages - pending_member pattern: persistent keystore for HPKE init key, replenish after join - Self-DM handled as local-only notepad (no MLS/server channel) - ANSI display module for colored prompts, incoming messages, status/error output Username resolution: - resolveIdentity RPC (@20 in node.capnp): look up username by identity key - Server: resolve_identity_key in Store trait, FileBackedStore, SqlStore - Client: resolve_identity in rpc.rs, used in auto-join for peer display names - resolveUser: bidirectional lookup (username → identity key) Encrypted local storage (nothing in cleartext): - ConversationStore uses SQLCipher when --state-password is provided - Argon2id key derivation with per-database random salt (.convdb-salt, mode 0600) - Transparent migration of existing unencrypted databases via sqlcipher_export - Token cache encrypted with QPCE format (Argon2id + ChaCha20Poly1305) Server changes: - resolveIdentity + resolveUser RPC handlers with auth + validation - Auth: sealed-sender identity binding on enqueue, channel member authorization - Delivery: hybrid decrypt attempts, identity key validation on enqueue - Config: --allow-sealed-sender flag for anonymous delivery mode - zeroize added to server dependencies Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
60 lines
1.5 KiB
TOML
60 lines
1.5 KiB
TOML
[package]
|
|
name = "quicnprotochat-server"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Delivery Service and Authentication Service for quicnprotochat."
|
|
license = "MIT"
|
|
|
|
[[bin]]
|
|
name = "quicnprotochat-server"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
quicnprotochat-core = { path = "../quicnprotochat-core" }
|
|
quicnprotochat-proto = { path = "../quicnprotochat-proto" }
|
|
|
|
# Serialisation + RPC
|
|
capnp = { workspace = true }
|
|
capnp-rpc = { workspace = true }
|
|
|
|
# Async
|
|
tokio = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
futures = { workspace = true }
|
|
|
|
# Server utilities
|
|
dashmap = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
quinn = { workspace = true }
|
|
quinn-proto = { workspace = true }
|
|
rustls = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
|
|
# Crypto — OPAQUE PAKE
|
|
opaque-ke = { workspace = true }
|
|
rand = { workspace = true }
|
|
subtle = { workspace = true }
|
|
zeroize = { workspace = true }
|
|
|
|
# Database
|
|
rusqlite = { workspace = true }
|
|
|
|
# Error handling
|
|
anyhow = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
bincode = { workspace = true }
|
|
serde = { workspace = true }
|
|
|
|
# CLI
|
|
clap = { workspace = true }
|
|
toml = { version = "0.8" }
|
|
|
|
# Metrics (Prometheus)
|
|
metrics = "0.22"
|
|
metrics-exporter-prometheus = "0.15"
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|