+ {#if showParentEntry}
+
+
+
+ {/if}
{#each subDirectories as { info }}
{/each}
diff --git a/src/routes/(main)/directory/[[id]]/DirectoryEntries/File.svelte b/src/routes/(main)/directory/[[id]]/DirectoryEntries/File.svelte
index 8251331..67d7e36 100644
--- a/src/routes/(main)/directory/[[id]]/DirectoryEntries/File.svelte
+++ b/src/routes/(main)/directory/[[id]]/DirectoryEntries/File.svelte
@@ -3,7 +3,7 @@
import { ActionEntryButton } from "$lib/components/atoms";
import { DirectoryEntryLabel } from "$lib/components/molecules";
import type { FileInfo } from "$lib/modules/filesystem";
- import { formatDateTime } from "$lib/modules/util";
+ import { formatDateTime } from "$lib/utils";
import { requestFileThumbnailDownload } from "./service";
import type { SelectedEntry } from "../service.svelte";
@@ -34,7 +34,7 @@
};
$effect(() => {
- if ($info?.dataKey) {
+ if ($info) {
requestFileThumbnailDownload($info.id, $info.dataKey)
.then((thumbnailUrl) => {
thumbnail = thumbnailUrl ?? undefined;
diff --git a/src/routes/(main)/directory/[[id]]/DirectoryEntries/UploadingFile.svelte b/src/routes/(main)/directory/[[id]]/DirectoryEntries/UploadingFile.svelte
index a6df05a..bf5e85a 100644
--- a/src/routes/(main)/directory/[[id]]/DirectoryEntries/UploadingFile.svelte
+++ b/src/routes/(main)/directory/[[id]]/DirectoryEntries/UploadingFile.svelte
@@ -1,7 +1,7 @@
+
+
+ 홈
+
+
+
+
ArkVault
+
+
goto("/gallery")} class="w-full">
+ 사진 및 동영상
+
+
+ {#each mediaFiles as file}
+ goto(`/file/${id}`)} />
+ {/each}
+
+
diff --git a/src/routes/(main)/home/service.ts b/src/routes/(main)/home/service.ts
new file mode 100644
index 0000000..6d02199
--- /dev/null
+++ b/src/routes/(main)/home/service.ts
@@ -0,0 +1,14 @@
+import { getAllFileInfos } from "$lib/indexedDB";
+
+export const requestFreshMediaFilesRetrieval = async (limit = 8) => {
+ const files = await getAllFileInfos();
+ files.sort(
+ (a, b) =>
+ (b.createdAt ?? b.lastModifiedAt).getTime() - (a.createdAt ?? a.lastModifiedAt).getTime(),
+ );
+ return files
+ .filter(
+ ({ contentType }) => contentType.startsWith("image/") || contentType.startsWith("video/"),
+ )
+ .slice(0, limit);
+};
diff --git a/src/routes/(main)/menu/+page.ts b/src/routes/(main)/menu/+page.ts
index 30a265a..8842540 100644
--- a/src/routes/(main)/menu/+page.ts
+++ b/src/routes/(main)/menu/+page.ts
@@ -1,14 +1,7 @@
-import { error } from "@sveltejs/kit";
-import { callGetApi } from "$lib/hooks";
-import type { UserInfoResponse } from "$lib/server/schemas";
+import { trpc } from "$trpc/client";
import type { PageLoad } from "./$types";
export const load: PageLoad = async ({ fetch }) => {
- const res = await callGetApi("/api/user", fetch);
- if (!res.ok) {
- error(500, "Internal server error");
- }
-
- const { nickname }: UserInfoResponse = await res.json();
+ const { nickname } = await trpc(fetch).user.get.query();
return { nickname };
};
diff --git a/src/routes/api/auth/changePassword/+server.ts b/src/routes/api/auth/changePassword/+server.ts
deleted file mode 100644
index 59129b8..0000000
--- a/src/routes/api/auth/changePassword/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { passwordChangeRequest } from "$lib/server/schemas";
-import { changePassword } from "$lib/server/services/auth";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { sessionId, userId } = await authorize(locals, "any");
-
- const zodRes = passwordChangeRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { oldPassword, newPassword } = zodRes.data;
-
- await changePassword(userId, sessionId, oldPassword, newPassword);
- return text("Password changed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/auth/login/+server.ts b/src/routes/api/auth/login/+server.ts
deleted file mode 100644
index d748f6a..0000000
--- a/src/routes/api/auth/login/+server.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import env from "$lib/server/loadenv";
-import { loginRequest } from "$lib/server/schemas";
-import { login } from "$lib/server/services/auth";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request, cookies }) => {
- const zodRes = loginRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { email, password } = zodRes.data;
-
- const { sessionIdSigned } = await login(email, password, locals.ip, locals.userAgent);
- cookies.set("sessionId", sessionIdSigned, {
- path: "/",
- maxAge: env.session.exp / 1000,
- secure: true,
- sameSite: "strict",
- });
-
- return text("Logged in", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/auth/logout/+server.ts b/src/routes/api/auth/logout/+server.ts
deleted file mode 100644
index b5c1f11..0000000
--- a/src/routes/api/auth/logout/+server.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { logout } from "$lib/server/services/auth";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, cookies }) => {
- const { sessionId } = await authorize(locals, "any");
-
- await logout(sessionId);
- cookies.delete("sessionId", { path: "/" });
-
- return text("Logged out", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/auth/upgradeSession/+server.ts b/src/routes/api/auth/upgradeSession/+server.ts
deleted file mode 100644
index fa0b6cf..0000000
--- a/src/routes/api/auth/upgradeSession/+server.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import {
- sessionUpgradeRequest,
- sessionUpgradeResponse,
- type SessionUpgradeResponse,
-} from "$lib/server/schemas";
-import { createSessionUpgradeChallenge } from "$lib/server/services/auth";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { sessionId, userId } = await authorize(locals, "notClient");
-
- const zodRes = sessionUpgradeRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { encPubKey, sigPubKey } = zodRes.data;
-
- const { id, challenge } = await createSessionUpgradeChallenge(
- sessionId,
- userId,
- locals.ip,
- encPubKey,
- sigPubKey,
- );
- return json(sessionUpgradeResponse.parse({ id, challenge } satisfies SessionUpgradeResponse));
-};
diff --git a/src/routes/api/auth/upgradeSession/verify/+server.ts b/src/routes/api/auth/upgradeSession/verify/+server.ts
deleted file mode 100644
index bbaedca..0000000
--- a/src/routes/api/auth/upgradeSession/verify/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { sessionUpgradeVerifyRequest } from "$lib/server/schemas";
-import { verifySessionUpgradeChallenge } from "$lib/server/services/auth";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { sessionId, userId } = await authorize(locals, "notClient");
-
- const zodRes = sessionUpgradeVerifyRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { id, answerSig, force } = zodRes.data;
-
- await verifySessionUpgradeChallenge(sessionId, userId, locals.ip, id, answerSig, force);
- return text("Session upgraded", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/category/[id]/+server.ts b/src/routes/api/category/[id]/+server.ts
deleted file mode 100644
index 4a486fa..0000000
--- a/src/routes/api/category/[id]/+server.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryInfoResponse, type CategoryInfoResponse } from "$lib/server/schemas";
-import { getCategoryInformation } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.union([z.enum(["root"]), z.coerce.number().int().positive()]),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- const { metadata, categories } = await getCategoryInformation(userId, id);
- return json(
- categoryInfoResponse.parse({
- metadata: metadata && {
- parent: metadata.parentId,
- mekVersion: metadata.mekVersion,
- dek: metadata.encDek,
- dekVersion: metadata.dekVersion.toISOString(),
- name: metadata.encName.ciphertext,
- nameIv: metadata.encName.iv,
- },
- subCategories: categories,
- } satisfies CategoryInfoResponse),
- );
-};
diff --git a/src/routes/api/category/[id]/delete/+server.ts b/src/routes/api/category/[id]/delete/+server.ts
deleted file mode 100644
index cbbe356..0000000
--- a/src/routes/api/category/[id]/delete/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { deleteCategory } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- await deleteCategory(userId, id);
- return text("Category deleted", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/category/[id]/file/add/+server.ts b/src/routes/api/category/[id]/file/add/+server.ts
deleted file mode 100644
index 2eaf2f2..0000000
--- a/src/routes/api/category/[id]/file/add/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryFileAddRequest } from "$lib/server/schemas";
-import { addCategoryFile } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const bodyZodRes = categoryFileAddRequest.safeParse(await request.json());
- if (!bodyZodRes.success) error(400, "Invalid request body");
- const { file } = bodyZodRes.data;
-
- await addCategoryFile(userId, id, file);
- return text("File added", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/category/[id]/file/list/+server.ts b/src/routes/api/category/[id]/file/list/+server.ts
deleted file mode 100644
index e354d8b..0000000
--- a/src/routes/api/category/[id]/file/list/+server.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryFileListResponse, type CategoryFileListResponse } from "$lib/server/schemas";
-import { getCategoryFiles } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals, url, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const queryZodRes = z
- .object({
- recurse: z
- .enum(["true", "false"])
- .transform((value) => value === "true")
- .nullable(),
- })
- .safeParse({ recurse: url.searchParams.get("recurse") });
- if (!queryZodRes.success) error(400, "Invalid query parameters");
- const { recurse } = queryZodRes.data;
-
- const { files } = await getCategoryFiles(userId, id, recurse ?? false);
- return json(
- categoryFileListResponse.parse({
- files: files.map(({ id, isRecursive }) => ({ file: id, isRecursive })),
- } satisfies CategoryFileListResponse),
- );
-};
diff --git a/src/routes/api/category/[id]/file/remove/+server.ts b/src/routes/api/category/[id]/file/remove/+server.ts
deleted file mode 100644
index 6fdcccf..0000000
--- a/src/routes/api/category/[id]/file/remove/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryFileRemoveRequest } from "$lib/server/schemas";
-import { removeCategoryFile } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const bodyZodRes = categoryFileRemoveRequest.safeParse(await request.json());
- if (!bodyZodRes.success) error(400, "Invalid request body");
- const { file } = bodyZodRes.data;
-
- await removeCategoryFile(userId, id, file);
- return text("File removed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/category/[id]/rename/+server.ts b/src/routes/api/category/[id]/rename/+server.ts
deleted file mode 100644
index 5351544..0000000
--- a/src/routes/api/category/[id]/rename/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryRenameRequest } from "$lib/server/schemas";
-import { renameCategory } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const bodyZodRes = categoryRenameRequest.safeParse(await request.json());
- if (!bodyZodRes.success) error(400, "Invalid request body");
- const { dekVersion, name, nameIv } = bodyZodRes.data;
-
- await renameCategory(userId, id, new Date(dekVersion), { ciphertext: name, iv: nameIv });
- return text("Category renamed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/category/create/+server.ts b/src/routes/api/category/create/+server.ts
deleted file mode 100644
index 216d850..0000000
--- a/src/routes/api/category/create/+server.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { categoryCreateRequest } from "$lib/server/schemas";
-import { createCategory } from "$lib/server/services/category";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = categoryCreateRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { parent, mekVersion, dek, dekVersion, name, nameIv } = zodRes.data;
-
- await createCategory({
- userId,
- parentId: parent,
- mekVersion,
- encDek: dek,
- dekVersion: new Date(dekVersion),
- encName: { ciphertext: name, iv: nameIv },
- });
- return text("Category created", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/client/list/+server.ts b/src/routes/api/client/list/+server.ts
deleted file mode 100644
index 78193ee..0000000
--- a/src/routes/api/client/list/+server.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { clientListResponse, type ClientListResponse } from "$lib/server/schemas";
-import { getUserClientList } from "$lib/server/services/client";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId } = await authorize(locals, "anyClient");
- const { userClients } = await getUserClientList(userId);
- return json(clientListResponse.parse({ clients: userClients } satisfies ClientListResponse));
-};
diff --git a/src/routes/api/client/register/+server.ts b/src/routes/api/client/register/+server.ts
deleted file mode 100644
index 5ac2a53..0000000
--- a/src/routes/api/client/register/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import {
- clientRegisterRequest,
- clientRegisterResponse,
- type ClientRegisterResponse,
-} from "$lib/server/schemas";
-import { registerUserClient } from "$lib/server/services/client";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "notClient");
-
- const zodRes = clientRegisterRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { encPubKey, sigPubKey } = zodRes.data;
-
- const { id, challenge } = await registerUserClient(userId, locals.ip, encPubKey, sigPubKey);
- return json(clientRegisterResponse.parse({ id, challenge } satisfies ClientRegisterResponse));
-};
diff --git a/src/routes/api/client/register/verify/+server.ts b/src/routes/api/client/register/verify/+server.ts
deleted file mode 100644
index 5ac9396..0000000
--- a/src/routes/api/client/register/verify/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { clientRegisterVerifyRequest } from "$lib/server/schemas";
-import { verifyUserClient } from "$lib/server/services/client";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "notClient");
-
- const zodRes = clientRegisterVerifyRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { id, answerSig } = zodRes.data;
-
- await verifyUserClient(userId, locals.ip, id, answerSig);
- return text("Client verified", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/client/status/+server.ts b/src/routes/api/client/status/+server.ts
deleted file mode 100644
index a7ecc82..0000000
--- a/src/routes/api/client/status/+server.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { clientStatusResponse, type ClientStatusResponse } from "$lib/server/schemas";
-import { getUserClientStatus } from "$lib/server/services/client";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId, clientId } = await authorize(locals, "anyClient");
- const { state, isInitialMekNeeded } = await getUserClientStatus(userId, clientId);
- return json(
- clientStatusResponse.parse({
- id: clientId,
- state,
- isInitialMekNeeded,
- } satisfies ClientStatusResponse),
- );
-};
diff --git a/src/routes/api/directory/[id]/+server.ts b/src/routes/api/directory/[id]/+server.ts
deleted file mode 100644
index 8189160..0000000
--- a/src/routes/api/directory/[id]/+server.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { directoryInfoResponse, type DirectoryInfoResponse } from "$lib/server/schemas";
-import { getDirectoryInformation } from "$lib/server/services/directory";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.union([z.enum(["root"]), z.coerce.number().int().positive()]),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- const { metadata, directories, files } = await getDirectoryInformation(userId, id);
- return json(
- directoryInfoResponse.parse({
- metadata: metadata && {
- parent: metadata.parentId,
- mekVersion: metadata.mekVersion,
- dek: metadata.encDek,
- dekVersion: metadata.dekVersion.toISOString(),
- name: metadata.encName.ciphertext,
- nameIv: metadata.encName.iv,
- },
- subDirectories: directories,
- files,
- } satisfies DirectoryInfoResponse),
- );
-};
diff --git a/src/routes/api/directory/[id]/delete/+server.ts b/src/routes/api/directory/[id]/delete/+server.ts
deleted file mode 100644
index 4d29fd8..0000000
--- a/src/routes/api/directory/[id]/delete/+server.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { directoryDeleteResponse, type DirectoryDeleteResponse } from "$lib/server/schemas";
-import { deleteDirectory } from "$lib/server/services/directory";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- const { files } = await deleteDirectory(userId, id);
- return json(
- directoryDeleteResponse.parse({ deletedFiles: files } satisfies DirectoryDeleteResponse),
- );
-};
diff --git a/src/routes/api/directory/[id]/rename/+server.ts b/src/routes/api/directory/[id]/rename/+server.ts
deleted file mode 100644
index cc50b2f..0000000
--- a/src/routes/api/directory/[id]/rename/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { directoryRenameRequest } from "$lib/server/schemas";
-import { renameDirectory } from "$lib/server/services/directory";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const bodyZodRes = directoryRenameRequest.safeParse(await request.json());
- if (!bodyZodRes.success) error(400, "Invalid request body");
- const { dekVersion, name, nameIv } = bodyZodRes.data;
-
- await renameDirectory(userId, id, new Date(dekVersion), { ciphertext: name, iv: nameIv });
- return text("Directory renamed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/directory/create/+server.ts b/src/routes/api/directory/create/+server.ts
deleted file mode 100644
index 7c65436..0000000
--- a/src/routes/api/directory/create/+server.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { directoryCreateRequest } from "$lib/server/schemas";
-import { createDirectory } from "$lib/server/services/directory";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = directoryCreateRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { parent, mekVersion, dek, dekVersion, name, nameIv } = zodRes.data;
-
- await createDirectory({
- userId,
- parentId: parent,
- mekVersion,
- encDek: dek,
- dekVersion: new Date(dekVersion),
- encName: { ciphertext: name, iv: nameIv },
- });
- return text("Directory created", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/file/[id]/+server.ts b/src/routes/api/file/[id]/+server.ts
deleted file mode 100644
index 23e9385..0000000
--- a/src/routes/api/file/[id]/+server.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { fileInfoResponse, type FileInfoResponse } from "$lib/server/schemas";
-import { getFileInformation } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- const {
- parentId,
- mekVersion,
- encDek,
- dekVersion,
- contentType,
- encContentIv,
- encName,
- encCreatedAt,
- encLastModifiedAt,
- categories,
- } = await getFileInformation(userId, id);
- return json(
- fileInfoResponse.parse({
- parent: parentId,
- mekVersion,
- dek: encDek,
- dekVersion: dekVersion.toISOString(),
- contentType: contentType,
- contentIv: encContentIv,
- name: encName.ciphertext,
- nameIv: encName.iv,
- createdAt: encCreatedAt?.ciphertext,
- createdAtIv: encCreatedAt?.iv,
- lastModifiedAt: encLastModifiedAt.ciphertext,
- lastModifiedAtIv: encLastModifiedAt.iv,
- categories,
- } satisfies FileInfoResponse),
- );
-};
diff --git a/src/routes/api/file/[id]/delete/+server.ts b/src/routes/api/file/[id]/delete/+server.ts
deleted file mode 100644
index 7baac25..0000000
--- a/src/routes/api/file/[id]/delete/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { deleteFile } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- await deleteFile(userId, id);
- return text("File deleted", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/file/[id]/rename/+server.ts b/src/routes/api/file/[id]/rename/+server.ts
deleted file mode 100644
index 343f146..0000000
--- a/src/routes/api/file/[id]/rename/+server.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { fileRenameRequest } from "$lib/server/schemas";
-import { renameFile } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, params, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const paramsZodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!paramsZodRes.success) error(400, "Invalid path parameters");
- const { id } = paramsZodRes.data;
-
- const bodyZodRes = fileRenameRequest.safeParse(await request.json());
- if (!bodyZodRes.success) error(400, "Invalid request body");
- const { dekVersion, name, nameIv } = bodyZodRes.data;
-
- await renameFile(userId, id, new Date(dekVersion), { ciphertext: name, iv: nameIv });
- return text("File renamed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/file/[id]/thumbnail/+server.ts b/src/routes/api/file/[id]/thumbnail/+server.ts
deleted file mode 100644
index 12c9347..0000000
--- a/src/routes/api/file/[id]/thumbnail/+server.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { z } from "zod";
-import { authorize } from "$lib/server/modules/auth";
-import { fileThumbnailInfoResponse, type FileThumbnailInfoResponse } from "$lib/server/schemas";
-import { getFileThumbnailInformation } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals, params }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = z
- .object({
- id: z.coerce.number().int().positive(),
- })
- .safeParse(params);
- if (!zodRes.success) error(400, "Invalid path parameters");
- const { id } = zodRes.data;
-
- const { updatedAt, encContentIv } = await getFileThumbnailInformation(userId, id);
- return json(
- fileThumbnailInfoResponse.parse({
- updatedAt: updatedAt.toISOString(),
- contentIv: encContentIv,
- } satisfies FileThumbnailInfoResponse),
- );
-};
diff --git a/src/routes/api/file/list/+server.ts b/src/routes/api/file/list/+server.ts
deleted file mode 100644
index c1b6888..0000000
--- a/src/routes/api/file/list/+server.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { fileListResponse, type FileListResponse } from "$lib/server/schemas";
-import { getFileList } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId } = await authorize(locals, "activeClient");
- const { files } = await getFileList(userId);
- return json(fileListResponse.parse({ files } satisfies FileListResponse));
-};
diff --git a/src/routes/api/file/scanDuplicates/+server.ts b/src/routes/api/file/scanDuplicates/+server.ts
deleted file mode 100644
index fb41b43..0000000
--- a/src/routes/api/file/scanDuplicates/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { error, json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import {
- duplicateFileScanRequest,
- duplicateFileScanResponse,
- type DuplicateFileScanResponse,
-} from "$lib/server/schemas";
-import { scanDuplicateFiles } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "activeClient");
-
- const zodRes = duplicateFileScanRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { hskVersion, contentHmac } = zodRes.data;
-
- const { files } = await scanDuplicateFiles(userId, hskVersion, contentHmac);
- return json(duplicateFileScanResponse.parse({ files } satisfies DuplicateFileScanResponse));
-};
diff --git a/src/routes/api/file/scanMissingThumbnails/+server.ts b/src/routes/api/file/scanMissingThumbnails/+server.ts
deleted file mode 100644
index bf2a2a6..0000000
--- a/src/routes/api/file/scanMissingThumbnails/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import {
- missingThumbnailFileScanResponse,
- type MissingThumbnailFileScanResponse,
-} from "$lib/server/schemas/file";
-import { scanMissingFileThumbnails } from "$lib/server/services/file";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals }) => {
- const { userId } = await authorize(locals, "activeClient");
- const { files } = await scanMissingFileThumbnails(userId);
- return json(
- missingThumbnailFileScanResponse.parse({ files } satisfies MissingThumbnailFileScanResponse),
- );
-};
diff --git a/src/routes/api/hsk/list/+server.ts b/src/routes/api/hsk/list/+server.ts
deleted file mode 100644
index 50957a3..0000000
--- a/src/routes/api/hsk/list/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { hmacSecretListResponse, type HmacSecretListResponse } from "$lib/server/schemas";
-import { getHskList } from "$lib/server/services/hsk";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId } = await authorize(locals, "activeClient");
- const { encHsks } = await getHskList(userId);
- return json(
- hmacSecretListResponse.parse({
- hsks: encHsks.map(({ version, state, mekVersion, encHsk }) => ({
- version,
- state,
- mekVersion,
- hsk: encHsk,
- })),
- } satisfies HmacSecretListResponse),
- );
-};
diff --git a/src/routes/api/hsk/register/initial/+server.ts b/src/routes/api/hsk/register/initial/+server.ts
deleted file mode 100644
index 8b32952..0000000
--- a/src/routes/api/hsk/register/initial/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { initialHmacSecretRegisterRequest } from "$lib/server/schemas";
-import { registerInitialActiveHsk } from "$lib/server/services/hsk";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId, clientId } = await authorize(locals, "activeClient");
-
- const zodRes = initialHmacSecretRegisterRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { mekVersion, hsk } = zodRes.data;
-
- await registerInitialActiveHsk(userId, clientId, mekVersion, hsk);
- return text("HSK registered", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/mek/list/+server.ts b/src/routes/api/mek/list/+server.ts
deleted file mode 100644
index b3df9fe..0000000
--- a/src/routes/api/mek/list/+server.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { masterKeyListResponse, type MasterKeyListResponse } from "$lib/server/schemas";
-import { getClientMekList } from "$lib/server/services/mek";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId, clientId } = await authorize(locals, "activeClient");
- const { encMeks } = await getClientMekList(userId, clientId);
- return json(
- masterKeyListResponse.parse({
- meks: encMeks.map(({ version, state, encMek, encMekSig }) => ({
- version,
- state,
- mek: encMek,
- mekSig: encMekSig,
- })),
- } satisfies MasterKeyListResponse),
- );
-};
diff --git a/src/routes/api/mek/register/initial/+server.ts b/src/routes/api/mek/register/initial/+server.ts
deleted file mode 100644
index bb761e2..0000000
--- a/src/routes/api/mek/register/initial/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { initialMasterKeyRegisterRequest } from "$lib/server/schemas";
-import { registerInitialActiveMek } from "$lib/server/services/mek";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId, clientId } = await authorize(locals, "pendingClient");
-
- const zodRes = initialMasterKeyRegisterRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { mek, mekSig } = zodRes.data;
-
- await registerInitialActiveMek(userId, clientId, mek, mekSig);
- return text("MEK registered", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/routes/api/trpc/[trpc]/+server.ts b/src/routes/api/trpc/[trpc]/+server.ts
new file mode 100644
index 0000000..ec1320a
--- /dev/null
+++ b/src/routes/api/trpc/[trpc]/+server.ts
@@ -0,0 +1,15 @@
+import { fetchRequestHandler } from "@trpc/server/adapters/fetch";
+import { createContext } from "$trpc/init.server";
+import { appRouter } from "$trpc/router.server";
+import type { RequestHandler } from "./$types";
+
+const trpcHandler: RequestHandler = (event) =>
+ fetchRequestHandler({
+ endpoint: "/api/trpc",
+ req: event.request,
+ router: appRouter,
+ createContext: () => createContext(event),
+ });
+
+export const GET = trpcHandler;
+export const POST = trpcHandler;
diff --git a/src/routes/api/user/+server.ts b/src/routes/api/user/+server.ts
deleted file mode 100644
index b10b13e..0000000
--- a/src/routes/api/user/+server.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { json } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { userInfoResponse, type UserInfoResponse } from "$lib/server/schemas";
-import { getUserInformation } from "$lib/server/services/user";
-import type { RequestHandler } from "./$types";
-
-export const GET: RequestHandler = async ({ locals }) => {
- const { userId } = await authorize(locals, "any");
- const { email, nickname } = await getUserInformation(userId);
- return json(userInfoResponse.parse({ email, nickname } satisfies UserInfoResponse));
-};
diff --git a/src/routes/api/user/changeNickname/+server.ts b/src/routes/api/user/changeNickname/+server.ts
deleted file mode 100644
index ad651ac..0000000
--- a/src/routes/api/user/changeNickname/+server.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { error, text } from "@sveltejs/kit";
-import { authorize } from "$lib/server/modules/auth";
-import { nicknameChangeRequest } from "$lib/server/schemas";
-import { changeNickname } from "$lib/server/services/user";
-import type { RequestHandler } from "./$types";
-
-export const POST: RequestHandler = async ({ locals, request }) => {
- const { userId } = await authorize(locals, "any");
-
- const zodRes = nicknameChangeRequest.safeParse(await request.json());
- if (!zodRes.success) error(400, "Invalid request body");
- const { newNickname } = zodRes.data;
-
- await changeNickname(userId, newNickname);
- return text("Nickname changed", { headers: { "Content-Type": "text/plain" } });
-};
diff --git a/src/trpc/client.ts b/src/trpc/client.ts
new file mode 100644
index 0000000..a6e2f8b
--- /dev/null
+++ b/src/trpc/client.ts
@@ -0,0 +1,26 @@
+import { createTRPCClient, httpBatchLink } from "@trpc/client";
+import superjson from "superjson";
+import { browser } from "$app/environment";
+import type { AppRouter } from "./router.server";
+
+const createClient = (fetch: typeof globalThis.fetch) =>
+ createTRPCClient
({
+ links: [
+ httpBatchLink({
+ url: "/api/trpc",
+ maxURLLength: 4096,
+ transformer: superjson,
+ fetch,
+ }),
+ ],
+ });
+
+let browserClient: ReturnType;
+
+export const trpc = (fetch = globalThis.fetch) => {
+ const client = browserClient ?? createClient(fetch);
+ if (browser) {
+ browserClient ??= client;
+ }
+ return client;
+};
diff --git a/src/trpc/init.server.ts b/src/trpc/init.server.ts
new file mode 100644
index 0000000..8d5d7c5
--- /dev/null
+++ b/src/trpc/init.server.ts
@@ -0,0 +1,26 @@
+import type { RequestEvent } from "@sveltejs/kit";
+import { initTRPC, TRPCError } from "@trpc/server";
+import superjson from "superjson";
+import { authorizeMiddleware, authorizeClientMiddleware } from "./middlewares/authorize";
+
+export const createContext = (event: RequestEvent) => event;
+export type Context = Awaited>;
+
+export const t = initTRPC.context().create({ transformer: superjson });
+export const router = t.router;
+export const publicProcedure = t.procedure;
+
+const authedProcedure = publicProcedure.use(async ({ ctx, next }) => {
+ if (!ctx.locals.session) {
+ throw new TRPCError({ code: "UNAUTHORIZED" });
+ }
+ return next();
+});
+
+export const roleProcedure = {
+ any: authedProcedure.use(authorizeMiddleware("any")),
+ notClient: authedProcedure.use(authorizeMiddleware("notClient")),
+ anyClient: authedProcedure.use(authorizeClientMiddleware("anyClient")),
+ pendingClient: authedProcedure.use(authorizeClientMiddleware("pendingClient")),
+ activeClient: authedProcedure.use(authorizeClientMiddleware("activeClient")),
+};
diff --git a/src/trpc/middlewares/authorize.ts b/src/trpc/middlewares/authorize.ts
new file mode 100644
index 0000000..53413b3
--- /dev/null
+++ b/src/trpc/middlewares/authorize.ts
@@ -0,0 +1,36 @@
+import { TRPCError } from "@trpc/server";
+import {
+ AuthorizationError,
+ authorizeInternal,
+ type ClientSession,
+ type SessionPermission,
+} from "$lib/server/modules/auth";
+import { t } from "../init.server";
+
+const authorize = async (locals: App.Locals, requiredPermission: SessionPermission) => {
+ try {
+ return await authorizeInternal(locals, requiredPermission);
+ } catch (e) {
+ if (e instanceof AuthorizationError) {
+ throw new TRPCError({
+ code: e.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
+ message: e.message,
+ });
+ }
+ throw e;
+ }
+};
+
+export const authorizeMiddleware = (requiredPermission: "any" | "notClient") =>
+ t.middleware(async ({ ctx, next }) => {
+ const session = await authorize(ctx.locals, requiredPermission);
+ return next({ ctx: { session } });
+ });
+
+export const authorizeClientMiddleware = (
+ requiredPermission: "anyClient" | "pendingClient" | "activeClient",
+) =>
+ t.middleware(async ({ ctx, next }) => {
+ const session = (await authorize(ctx.locals, requiredPermission)) as ClientSession;
+ return next({ ctx: { session } });
+ });
diff --git a/src/trpc/router.server.ts b/src/trpc/router.server.ts
new file mode 100644
index 0000000..64d25c7
--- /dev/null
+++ b/src/trpc/router.server.ts
@@ -0,0 +1,30 @@
+import type { RequestEvent } from "@sveltejs/kit";
+import type { inferRouterInputs, inferRouterOutputs } from "@trpc/server";
+import { createContext, router } from "./init.server";
+import {
+ authRouter,
+ categoryRouter,
+ clientRouter,
+ directoryRouter,
+ fileRouter,
+ hskRouter,
+ mekRouter,
+ userRouter,
+} from "./routers";
+
+export const appRouter = router({
+ auth: authRouter,
+ category: categoryRouter,
+ client: clientRouter,
+ directory: directoryRouter,
+ file: fileRouter,
+ hsk: hskRouter,
+ mek: mekRouter,
+ user: userRouter,
+});
+
+export const createCaller = (event: RequestEvent) => appRouter.createCaller(createContext(event));
+
+export type AppRouter = typeof appRouter;
+export type RouterInputs = inferRouterInputs;
+export type RouterOutputs = inferRouterOutputs;
diff --git a/src/trpc/routers/auth.ts b/src/trpc/routers/auth.ts
new file mode 100644
index 0000000..e0d3d50
--- /dev/null
+++ b/src/trpc/routers/auth.ts
@@ -0,0 +1,142 @@
+import { TRPCError } from "@trpc/server";
+import argon2 from "argon2";
+import { z } from "zod";
+import { ClientRepo, SessionRepo, UserRepo, IntegrityError } from "$lib/server/db";
+import env from "$lib/server/loadenv";
+import { cookieOptions } from "$lib/server/modules/auth";
+import { generateChallenge, verifySignature, issueSessionId } from "$lib/server/modules/crypto";
+import { router, publicProcedure, roleProcedure } from "../init.server";
+
+const authRouter = router({
+ login: publicProcedure
+ .input(
+ z.object({
+ email: z.email(),
+ password: z.string().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const user = await UserRepo.getUserByEmail(input.email);
+ if (!user || !(await argon2.verify(user.password, input.password))) {
+ throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid email or password" });
+ }
+
+ const { sessionId, sessionIdSigned } = await issueSessionId(32, env.session.secret);
+ await SessionRepo.createSession(user.id, sessionId, ctx.locals.ip, ctx.locals.userAgent);
+ ctx.cookies.set("sessionId", sessionIdSigned, cookieOptions);
+ }),
+
+ logout: roleProcedure["any"].mutation(async ({ ctx }) => {
+ await SessionRepo.deleteSession(ctx.session.sessionId);
+ ctx.cookies.delete("sessionId", cookieOptions);
+ }),
+
+ changePassword: roleProcedure["any"]
+ .input(
+ z.object({
+ oldPassword: z.string().nonempty(),
+ newPassword: z.string().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ if (input.oldPassword === input.newPassword) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Same passwords" });
+ } else if (input.newPassword.length < 8) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Too short password" });
+ }
+
+ const user = await UserRepo.getUser(ctx.session.userId);
+ if (!user) {
+ throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Invalid session id" });
+ } else if (!(await argon2.verify(user.password, input.oldPassword))) {
+ throw new TRPCError({ code: "FORBIDDEN", message: "Invalid password" });
+ }
+
+ await UserRepo.setUserPassword(ctx.session.userId, await argon2.hash(input.newPassword));
+ await SessionRepo.deleteAllOtherSessions(ctx.session.userId, ctx.session.sessionId);
+ }),
+
+ upgrade: roleProcedure["notClient"]
+ .input(
+ z.object({
+ encPubKey: z.base64().nonempty(),
+ sigPubKey: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const client = await ClientRepo.getClientByPubKeys(input.encPubKey, input.sigPubKey);
+ const userClient = client
+ ? await ClientRepo.getUserClient(ctx.session.userId, client.id)
+ : undefined;
+ if (!client) {
+ throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid public key(s)" });
+ } else if (!userClient || userClient.state === "challenging") {
+ throw new TRPCError({ code: "FORBIDDEN", message: "Unregistered client" });
+ }
+
+ const { answer, challenge } = await generateChallenge(32, input.encPubKey);
+ const { id } = await SessionRepo.registerSessionUpgradeChallenge(
+ ctx.session.sessionId,
+ client.id,
+ answer.toString("base64"),
+ ctx.locals.ip,
+ new Date(Date.now() + env.challenge.sessionUpgradeExp),
+ );
+
+ return { id, challenge: challenge.toString("base64") };
+ }),
+
+ verifyUpgrade: roleProcedure["notClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ answerSig: z.base64().nonempty(),
+ force: z.boolean().default(false),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const challenge = await SessionRepo.consumeSessionUpgradeChallenge(
+ input.id,
+ ctx.session.sessionId,
+ ctx.locals.ip,
+ );
+ if (!challenge) {
+ throw new TRPCError({ code: "FORBIDDEN", message: "Invalid challenge answer" });
+ }
+
+ const client = await ClientRepo.getClient(challenge.clientId);
+ if (!client) {
+ throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Invalid challenge answer" });
+ } else if (
+ !verifySignature(Buffer.from(challenge.answer, "base64"), input.answerSig, client.sigPubKey)
+ ) {
+ throw new TRPCError({
+ code: "FORBIDDEN",
+ message: "Invalid challenge answer signature",
+ });
+ }
+
+ try {
+ await SessionRepo.upgradeSession(
+ ctx.session.userId,
+ ctx.session.sessionId,
+ client.id,
+ input.force,
+ );
+ } catch (e) {
+ if (e instanceof IntegrityError) {
+ if (e.message === "Session not found") {
+ throw new TRPCError({
+ code: "INTERNAL_SERVER_ERROR",
+ message: "Invalid challenge answer",
+ });
+ } else if (!input.force && e.message === "Session already exists") {
+ throw new TRPCError({ code: "CONFLICT", message: "Already logged in" });
+ }
+ }
+ throw e;
+ }
+ }),
+});
+
+export default authRouter;
diff --git a/src/trpc/routers/category.ts b/src/trpc/routers/category.ts
new file mode 100644
index 0000000..2be80c8
--- /dev/null
+++ b/src/trpc/routers/category.ts
@@ -0,0 +1,194 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { CategoryRepo, FileRepo, IntegrityError } from "$lib/server/db";
+import { categoryIdSchema } from "$lib/server/schemas";
+import { router, roleProcedure } from "../init.server";
+
+const categoryRouter = router({
+ get: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: categoryIdSchema,
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ const category =
+ input.id !== "root"
+ ? await CategoryRepo.getCategory(ctx.session.userId, input.id)
+ : undefined;
+ if (category === null) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ }
+
+ const categories = await CategoryRepo.getAllCategoriesByParent(ctx.session.userId, input.id);
+ return {
+ metadata: category && {
+ parent: category.parentId,
+ mekVersion: category.mekVersion,
+ dek: category.encDek,
+ dekVersion: category.dekVersion,
+ name: category.encName.ciphertext,
+ nameIv: category.encName.iv,
+ },
+ subCategories: categories.map(({ id }) => id),
+ };
+ }),
+
+ create: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ parent: categoryIdSchema,
+ mekVersion: z.int().positive(),
+ dek: z.base64().nonempty(),
+ dekVersion: z.date(),
+ name: z.base64().nonempty(),
+ nameIv: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const oneMinuteAgo = new Date(Date.now() - 60 * 1000);
+ const oneMinuteLater = new Date(Date.now() + 60 * 1000);
+ if (input.dekVersion <= oneMinuteAgo || input.dekVersion >= oneMinuteLater) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid DEK version" });
+ }
+
+ try {
+ await CategoryRepo.registerCategory({
+ parentId: input.parent,
+ userId: ctx.session.userId,
+ mekVersion: input.mekVersion,
+ encDek: input.dek,
+ dekVersion: input.dekVersion,
+ encName: { ciphertext: input.name, iv: input.nameIv },
+ });
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "Inactive MEK version") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: e.message });
+ }
+ throw e;
+ }
+ }),
+
+ rename: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ dekVersion: z.date(),
+ name: z.base64().nonempty(),
+ nameIv: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ await CategoryRepo.setCategoryEncName(ctx.session.userId, input.id, input.dekVersion, {
+ ciphertext: input.name,
+ iv: input.nameIv,
+ });
+ } catch (e) {
+ if (e instanceof IntegrityError) {
+ if (e.message === "Category not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ } else if (e.message === "Invalid DEK version") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: e.message });
+ }
+ }
+ throw e;
+ }
+ }),
+
+ delete: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ await CategoryRepo.unregisterCategory(ctx.session.userId, input.id);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "Category not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ }
+ throw e;
+ }
+ }),
+
+ files: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ recurse: z.boolean().default(false),
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ const category = await CategoryRepo.getCategory(ctx.session.userId, input.id);
+ if (!category) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ }
+
+ const files = await FileRepo.getAllFilesByCategory(
+ ctx.session.userId,
+ input.id,
+ input.recurse,
+ );
+ return files.map(({ id, isRecursive }) => ({ file: id, isRecursive }));
+ }),
+
+ addFile: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ file: z.int().positive(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const [category, file] = await Promise.all([
+ CategoryRepo.getCategory(ctx.session.userId, input.id),
+ FileRepo.getFile(ctx.session.userId, input.file),
+ ]);
+ if (!category) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ } else if (!file) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid file id" });
+ }
+
+ try {
+ await FileRepo.addFileToCategory(input.file, input.id);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "File already added to category") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "File already added" });
+ }
+ throw e;
+ }
+ }),
+
+ removeFile: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ file: z.int().positive(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const [category, file] = await Promise.all([
+ CategoryRepo.getCategory(ctx.session.userId, input.id),
+ FileRepo.getFile(ctx.session.userId, input.file),
+ ]);
+ if (!category) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid category id" });
+ } else if (!file) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid file id" });
+ }
+
+ try {
+ await FileRepo.removeFileFromCategory(input.file, input.id);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "File not found in category") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "File not added" });
+ }
+ throw e;
+ }
+ }),
+});
+
+export default categoryRouter;
diff --git a/src/trpc/routers/client.ts b/src/trpc/routers/client.ts
new file mode 100644
index 0000000..49844f1
--- /dev/null
+++ b/src/trpc/routers/client.ts
@@ -0,0 +1,97 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { ClientRepo, IntegrityError } from "$lib/server/db";
+import env from "$lib/server/loadenv";
+import { verifyPubKey, verifySignature, generateChallenge } from "$lib/server/modules/crypto";
+import { router, roleProcedure } from "../init.server";
+
+const createUserClientChallenge = async (
+ ip: string,
+ userId: number,
+ clientId: number,
+ encPubKey: string,
+) => {
+ const { answer, challenge } = await generateChallenge(32, encPubKey);
+ const { id } = await ClientRepo.registerUserClientChallenge(
+ userId,
+ clientId,
+ answer.toString("base64"),
+ ip,
+ new Date(Date.now() + env.challenge.userClientExp),
+ );
+
+ return { id, challenge: challenge.toString("base64") };
+};
+
+const clientRouter = router({
+ register: roleProcedure["notClient"]
+ .input(
+ z.object({
+ encPubKey: z.base64().nonempty(),
+ sigPubKey: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const { userId } = ctx.session;
+ const { encPubKey, sigPubKey } = input;
+ const client = await ClientRepo.getClientByPubKeys(encPubKey, sigPubKey);
+ if (client) {
+ try {
+ await ClientRepo.createUserClient(userId, client.id);
+ return await createUserClientChallenge(ctx.locals.ip, userId, client.id, encPubKey);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "User client already exists") {
+ throw new TRPCError({ code: "CONFLICT", message: "Client already registered" });
+ }
+ throw e;
+ }
+ } else {
+ if (encPubKey === sigPubKey) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Same public keys" });
+ } else if (!verifyPubKey(encPubKey) || !verifyPubKey(sigPubKey)) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid public key(s)" });
+ }
+
+ try {
+ const { id: clientId } = await ClientRepo.createClient(encPubKey, sigPubKey, userId);
+ return await createUserClientChallenge(ctx.locals.ip, userId, clientId, encPubKey);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "Public key(s) already registered") {
+ throw new TRPCError({ code: "CONFLICT", message: "Public key(s) already used" });
+ }
+ throw e;
+ }
+ }
+ }),
+
+ verify: roleProcedure["notClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ answerSig: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const challenge = await ClientRepo.consumeUserClientChallenge(
+ input.id,
+ ctx.session.userId,
+ ctx.locals.ip,
+ );
+ if (!challenge) {
+ throw new TRPCError({ code: "FORBIDDEN", message: "Invalid challenge answer" });
+ }
+
+ const client = await ClientRepo.getClient(challenge.clientId);
+ if (!client) {
+ throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Invalid challenge answer" });
+ } else if (
+ !verifySignature(Buffer.from(challenge.answer, "base64"), input.answerSig, client.sigPubKey)
+ ) {
+ throw new TRPCError({ code: "FORBIDDEN", message: "Invalid challenge answer signature" });
+ }
+
+ await ClientRepo.setUserClientStateToPending(ctx.session.userId, client.id);
+ }),
+});
+
+export default clientRouter;
diff --git a/src/trpc/routers/directory.ts b/src/trpc/routers/directory.ts
new file mode 100644
index 0000000..e060c23
--- /dev/null
+++ b/src/trpc/routers/directory.ts
@@ -0,0 +1,127 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { FileRepo, IntegrityError } from "$lib/server/db";
+import { safeUnlink } from "$lib/server/modules/filesystem";
+import { directoryIdSchema } from "$lib/server/schemas";
+import { router, roleProcedure } from "../init.server";
+
+const directoryRouter = router({
+ get: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: directoryIdSchema,
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ const directory =
+ input.id !== "root" ? await FileRepo.getDirectory(ctx.session.userId, input.id) : undefined;
+ if (directory === null) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid directory id" });
+ }
+
+ const [directories, files] = await Promise.all([
+ FileRepo.getAllDirectoriesByParent(ctx.session.userId, input.id),
+ FileRepo.getAllFilesByParent(ctx.session.userId, input.id),
+ ]);
+ return {
+ metadata: directory && {
+ parent: directory.parentId,
+ mekVersion: directory.mekVersion,
+ dek: directory.encDek,
+ dekVersion: directory.dekVersion,
+ name: directory.encName.ciphertext,
+ nameIv: directory.encName.iv,
+ },
+ subDirectories: directories.map(({ id }) => id),
+ files: files.map(({ id }) => id),
+ };
+ }),
+
+ create: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ parent: directoryIdSchema,
+ mekVersion: z.int().positive(),
+ dek: z.base64().nonempty(),
+ dekVersion: z.date(),
+ name: z.base64().nonempty(),
+ nameIv: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const oneMinuteAgo = new Date(Date.now() - 60 * 1000);
+ const oneMinuteLater = new Date(Date.now() + 60 * 1000);
+ if (input.dekVersion <= oneMinuteAgo || input.dekVersion >= oneMinuteLater) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid DEK version" });
+ }
+
+ try {
+ await FileRepo.registerDirectory({
+ parentId: input.parent,
+ userId: ctx.session.userId,
+ mekVersion: input.mekVersion,
+ encDek: input.dek,
+ dekVersion: input.dekVersion,
+ encName: { ciphertext: input.name, iv: input.nameIv },
+ });
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "Inactive MEK version") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: e.message });
+ }
+ throw e;
+ }
+ }),
+
+ rename: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ dekVersion: z.date(),
+ name: z.base64().nonempty(),
+ nameIv: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ await FileRepo.setDirectoryEncName(ctx.session.userId, input.id, input.dekVersion, {
+ ciphertext: input.name,
+ iv: input.nameIv,
+ });
+ } catch (e) {
+ if (e instanceof IntegrityError) {
+ if (e.message === "Directory not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid directory id" });
+ } else if (e.message === "Invalid DEK version") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: e.message });
+ }
+ }
+ throw e;
+ }
+ }),
+
+ delete: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ const files = await FileRepo.unregisterDirectory(ctx.session.userId, input.id);
+ return {
+ deletedFiles: files.map((file) => {
+ safeUnlink(file.path); // Intended
+ safeUnlink(file.thumbnailPath); // Intended
+ return file.id;
+ }),
+ };
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "Directory not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid directory id" });
+ }
+ throw e;
+ }
+ }),
+});
+
+export default directoryRouter;
diff --git a/src/trpc/routers/file.ts b/src/trpc/routers/file.ts
new file mode 100644
index 0000000..decbc76
--- /dev/null
+++ b/src/trpc/routers/file.ts
@@ -0,0 +1,123 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { FileRepo, MediaRepo, IntegrityError } from "$lib/server/db";
+import { safeUnlink } from "$lib/server/modules/filesystem";
+import { router, roleProcedure } from "../init.server";
+
+const fileRouter = router({
+ get: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ const file = await FileRepo.getFile(ctx.session.userId, input.id);
+ if (!file) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid file id" });
+ }
+
+ const categories = await FileRepo.getAllFileCategories(input.id);
+ return {
+ parent: file.parentId,
+ mekVersion: file.mekVersion,
+ dek: file.encDek,
+ dekVersion: file.dekVersion,
+ contentType: file.contentType,
+ contentIv: file.encContentIv,
+ name: file.encName.ciphertext,
+ nameIv: file.encName.iv,
+ createdAt: file.encCreatedAt?.ciphertext,
+ createdAtIv: file.encCreatedAt?.iv,
+ lastModifiedAt: file.encLastModifiedAt.ciphertext,
+ lastModifiedAtIv: file.encLastModifiedAt.iv,
+ categories: categories.map(({ id }) => id),
+ };
+ }),
+
+ list: roleProcedure["activeClient"].query(async ({ ctx }) => {
+ return await FileRepo.getAllFileIds(ctx.session.userId);
+ }),
+
+ listByHash: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ hskVersion: z.int().positive(),
+ contentHmac: z.base64().nonempty(),
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ return await FileRepo.getAllFileIdsByContentHmac(
+ ctx.session.userId,
+ input.hskVersion,
+ input.contentHmac,
+ );
+ }),
+
+ listWithoutThumbnail: roleProcedure["activeClient"].query(async ({ ctx }) => {
+ return await MediaRepo.getMissingFileThumbnails(ctx.session.userId);
+ }),
+
+ rename: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ dekVersion: z.date(),
+ name: z.base64().nonempty(),
+ nameIv: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ await FileRepo.setFileEncName(ctx.session.userId, input.id, input.dekVersion, {
+ ciphertext: input.name,
+ iv: input.nameIv,
+ });
+ } catch (e) {
+ if (e instanceof IntegrityError) {
+ if (e.message === "File not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid file id" });
+ } else if (e.message === "Invalid DEK version") {
+ throw new TRPCError({ code: "BAD_REQUEST", message: e.message });
+ }
+ }
+ throw e;
+ }
+ }),
+
+ delete: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ const { path, thumbnailPath } = await FileRepo.unregisterFile(ctx.session.userId, input.id);
+ safeUnlink(path); // Intended
+ safeUnlink(thumbnailPath); // Intended
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "File not found") {
+ throw new TRPCError({ code: "NOT_FOUND", message: "Invalid file id" });
+ }
+ throw e;
+ }
+ }),
+
+ thumbnail: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ id: z.int().positive(),
+ }),
+ )
+ .query(async ({ ctx, input }) => {
+ const thumbnail = await MediaRepo.getFileThumbnail(ctx.session.userId, input.id);
+ if (!thumbnail) {
+ throw new TRPCError({ code: "NOT_FOUND", message: "File or its thumbnail not found" });
+ }
+
+ return { updatedAt: thumbnail.updatedAt, contentIv: thumbnail.encContentIv };
+ }),
+});
+
+export default fileRouter;
diff --git a/src/trpc/routers/hsk.ts b/src/trpc/routers/hsk.ts
new file mode 100644
index 0000000..1e39af0
--- /dev/null
+++ b/src/trpc/routers/hsk.ts
@@ -0,0 +1,41 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { HskRepo, IntegrityError } from "$lib/server/db";
+import { router, roleProcedure } from "../init.server";
+
+const hskRouter = router({
+ list: roleProcedure["activeClient"].query(async ({ ctx }) => {
+ const hsks = await HskRepo.getAllValidHsks(ctx.session.userId);
+ return hsks.map(({ version, state, mekVersion, encHsk }) => ({
+ version,
+ state,
+ mekVersion,
+ hsk: encHsk,
+ }));
+ }),
+
+ registerInitial: roleProcedure["activeClient"]
+ .input(
+ z.object({
+ mekVersion: z.int().positive(),
+ hsk: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ try {
+ await HskRepo.registerInitialHsk(
+ ctx.session.userId,
+ ctx.session.clientId,
+ input.mekVersion,
+ input.hsk,
+ );
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "HSK already registered") {
+ throw new TRPCError({ code: "CONFLICT", message: "Initial HSK already registered" });
+ }
+ throw e;
+ }
+ }),
+});
+
+export default hskRouter;
diff --git a/src/trpc/routers/index.ts b/src/trpc/routers/index.ts
new file mode 100644
index 0000000..ab5b6a0
--- /dev/null
+++ b/src/trpc/routers/index.ts
@@ -0,0 +1,8 @@
+export { default as authRouter } from "./auth";
+export { default as categoryRouter } from "./category";
+export { default as clientRouter } from "./client";
+export { default as directoryRouter } from "./directory";
+export { default as fileRouter } from "./file";
+export { default as hskRouter } from "./hsk";
+export { default as mekRouter } from "./mek";
+export { default as userRouter } from "./user";
diff --git a/src/trpc/routers/mek.ts b/src/trpc/routers/mek.ts
new file mode 100644
index 0000000..002d200
--- /dev/null
+++ b/src/trpc/routers/mek.ts
@@ -0,0 +1,63 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { ClientRepo, MekRepo, IntegrityError } from "$lib/server/db";
+import { verifySignature } from "$lib/server/modules/crypto";
+import { router, roleProcedure } from "../init.server";
+
+const verifyClientEncMekSig = async (
+ userId: number,
+ clientId: number,
+ version: number,
+ encMek: string,
+ encMekSig: string,
+) => {
+ const userClient = await ClientRepo.getUserClientWithDetails(userId, clientId);
+ if (!userClient) {
+ throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Invalid session id" });
+ }
+
+ const data = JSON.stringify({ version, key: encMek });
+ return verifySignature(Buffer.from(data), encMekSig, userClient.sigPubKey);
+};
+
+const mekRouter = router({
+ list: roleProcedure["activeClient"].query(async ({ ctx }) => {
+ const clientMeks = await MekRepo.getAllValidClientMeks(
+ ctx.session.userId,
+ ctx.session.clientId,
+ );
+ return clientMeks.map(({ version, state, encMek, encMekSig }) => ({
+ version,
+ state,
+ mek: encMek,
+ mekSig: encMekSig,
+ }));
+ }),
+
+ registerInitial: roleProcedure["pendingClient"]
+ .input(
+ z.object({
+ mek: z.base64().nonempty(),
+ mekSig: z.base64().nonempty(),
+ }),
+ )
+ .mutation(async ({ ctx, input }) => {
+ const { userId, clientId } = ctx.session;
+ const { mek, mekSig } = input;
+ if (!(await verifyClientEncMekSig(userId, clientId, 1, mek, mekSig))) {
+ throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid signature" });
+ }
+
+ try {
+ await MekRepo.registerInitialMek(userId, clientId, mek, mekSig);
+ await ClientRepo.setUserClientStateToActive(userId, clientId);
+ } catch (e) {
+ if (e instanceof IntegrityError && e.message === "MEK already registered") {
+ throw new TRPCError({ code: "CONFLICT", message: "Initial MEK already registered" });
+ }
+ throw e;
+ }
+ }),
+});
+
+export default mekRouter;
diff --git a/src/trpc/routers/user.ts b/src/trpc/routers/user.ts
new file mode 100644
index 0000000..ec514f1
--- /dev/null
+++ b/src/trpc/routers/user.ts
@@ -0,0 +1,16 @@
+import { TRPCError } from "@trpc/server";
+import { UserRepo } from "$lib/server/db";
+import { router, roleProcedure } from "../init.server";
+
+const userRouter = router({
+ get: roleProcedure["any"].query(async ({ ctx }) => {
+ const user = await UserRepo.getUser(ctx.session.userId);
+ if (!user) {
+ throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Invalid session id" });
+ }
+
+ return { email: user.email, nickname: user.nickname };
+ }),
+});
+
+export default userRouter;
diff --git a/svelte.config.js b/svelte.config.js
index bbef2bb..4ffc844 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -3,15 +3,12 @@ import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
/** @type {import('@sveltejs/kit').Config} */
const config = {
- // Consult https://svelte.dev/docs/kit/integrations
- // for more information about preprocessors
preprocess: vitePreprocess(),
-
kit: {
- // adapter-auto only supports some environments, see https://svelte.dev/docs/kit/adapter-auto for a list.
- // If your environment is not supported, or you settled on a specific environment, switch out the adapter.
- // See https://svelte.dev/docs/kit/adapters for more information about adapters.
adapter: adapter(),
+ alias: {
+ $trpc: "./src/trpc",
+ },
},
};