eleven / messenger Public

Home server MVP: anonymous passkey-gated backup store (#112)

* home: anonymous passkey-gated blob store (server, web UI, tests)

The home-server MVP from docs/onboarding-and-home-server.md: a separate
static Go binary (go build ./home) that stores, per anonymous user, WebAuthn
credential public keys, ONE opaque client-encrypted blob (plaintext padded to
a fixed 16 KiB before encryption; last 5 versions kept), and hashed device
link tokens. No email/username/display name anywhere.

Ceremonies via github.com/go-webauthn/webauthn (discoverable, resident-key +
user-verification required). The PRF extension is requested and evaluated
client-side only: PRF -> HKDF -> KEK, envelope encryption (random DEK wrapped
per-passkey), and the serializer strips PRF results so the output never
reaches the server. Destructive ops (revoke device, delete blob) demand a
fresh ceremony proof (5-min window, hashed) — a stolen link token can read
and update but never reduce access. begin endpoints are per-IP rate-limited.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* home: deploy script, container config, README

deploy-home.sh mirrors deploy-instance.sh (templated per-instance app.toml,
data-safe redeploys, no admin token — there is none). The RP origin is the
one per-instance knob; changing the hostname later orphans passkeys, so the
script says to pick it once. README records the additive-only invariant and
the who-sees-what table from the design doc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* home: security review fixes — link tokens can't enrol passkeys; no dormant postMessage receiver; crypto tests

1. CRITICAL: register/begin no longer accepts a link token to attach a new
   credential to an existing account — that escalated a stolen read/write
   token into permanent takeover (enrol attacker passkey -> login -> fresh
   ceremony proof -> destroy blob, revoke devices). Adding a passkey now
   requires a FRESH ceremony proof; a presented link token is refused (403)
   rather than ignored, so a client meaning "add to my account" can't
   silently enrol a second, empty account. Link tokens authorise exactly
   blob read/write + the devices listing. Also adds ceremony-gated
   DELETE /api/credentials/{id} so a rogue/lost passkey can be removed,
   refusing to delete the last credential (that would orphan the blob —
   blob delete is the wind-down path).

2. IMPORTANT: the postMessage receiver stub is removed from home.js — it
   accepted eleven-home-add entries from ANY origin, letting any site that
   window.open'd the page inject a spoofed server entry into the synced
   backup. No receiver ships until the sender does; the comment records
   that it must land with a strict e.origin allowlist + user confirmation.

3. IMPORTANT: home/web/static/crypto.js now has Node test coverage
   (home/test/crypto.test.mjs, wired into npm test): pad/unpad round-trips
   incl. the BLOB_PAD-4 boundary + over-limit rejection, fixed-size padding,
   seal/open round-trip, wrong-KEK unwrap failure, and the two-passkey
   envelope where each KEK opens the blob.

Tests updated/added: TestRegisterBeginOptions (proof-gated exclusions),
TestRegisterBeginRefusesLinkToken, TestCredentialDeleteRequiresCeremony.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>