| 1 | // 🤖 integrity.js — client-side tamper-evidence: verify the instance's signed |
| 2 | // checkpoint chain and gossip chain heads between members inside E2EE traffic |
| 3 | // (docs/tamper-evidence.md, #573 slice 2). |
| 4 | // |
| 5 | // The shell polls GET /api/checkpoints, verifies each new checkpoint (Ed25519 |
| 6 | // signature where WebCrypto supports it, chain-hash recomputation and linkage |
| 7 | // always), and remembers the verified head. Outgoing messages carry that head |
| 8 | // as a tiny `_ckpt` field inside the encrypted payload — the host can't read |
| 9 | // it, so it can't selectively strip it — and incoming gossip (live AND from |
| 10 | // history/catch-up, since the host chooses which path a message arrives by) |
| 11 | // is compared against our own view. An honest server serves ONE checkpoints |
| 12 | // table to every member, so checkpoint boundaries are global: a peer boundary |
| 13 | // inside our verified window that we don't have is itself a fork, the same as |
| 14 | // a mismatched chain at a shared boundary. A peer's head the server won't |
| 15 | // show us within a grace period is withholding. Detection only in this slice — |
| 16 | // alerts are recorded and surfaced via /integrity, never a scary banner (that |
| 17 | // UX needs its own design pass). |
| 18 | // |
| 19 | // Every verification failure must END as a recorded alert, never a thrown |
| 20 | // exception — a monitor that dies quietly on malformed input is an alarm- |
| 21 | // suppression vector (serve one garbled row, freeze every member's monitor). |
| 22 | // |
| 23 | // Pure functions up top (unit-tested in Node, test/integrity.test.mjs); the |
| 24 | // stateful monitor below takes storage/fetch as plain objects so tests can |
| 25 | // inject fakes. Wire-format constants mirror checkpoint.go — the Go test |
| 26 | // vectors pin them on both sides. |
| 27 | |
| 28 | const CHAIN_DOMAIN = "lchat-ckpt-chain\n"; |
| 29 | const LEAF_DOMAIN = "lchat-ckpt-leaf\n"; |
| 30 | const NODE_DOMAIN = "lchat-ckpt-node\n"; |
| 31 | |
| 32 | // How long a gossiped head may stay ahead of everything the server shows us |
| 33 | // before we call it withholding. Generous: the sweep runs every 5 minutes. |
| 34 | export const AHEAD_GRACE_MS = 15 * 60 * 1000; |
| 35 | |
| 36 | const HIST_KEEP = 64; // (seqTo -> chain) boundary pairs kept for old gossip |
| 37 | const ROOTS_KEEP = 64; // verified checkpoint roots kept (inclusion-proof trust) |
| 38 | const ALERTS_KEEP = 20; |
| 39 | const PAGE_SIZE = 100; // server page size (checkpointsAfter limit) |
| 40 | |
| 41 | async function sha256hex(str) { |
| 42 | const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(str)); |
| 43 | return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, "0")).join(""); |
| 44 | } |
| 45 | |
| 46 | // chainHashHex mirrors checkpoint.go's chainHash — a checkpoint's commitment |
| 47 | // to its predecessor. prev is "" for the genesis checkpoint. |
| 48 | export function chainHashHex(prev, root, seqTo) { |
| 49 | return sha256hex(CHAIN_DOMAIN + prev + "\n" + root + "\n" + String(seqTo)); |
| 50 | } |
| 51 | |
| 52 | // ---- inclusion proofs (docs/tamper-evidence.md client sampling) ----------- |
| 53 | // Mirror of checkpoint.go's journalLeafHash / merkleNode / rootFromAuditPath, |
| 54 | // so a client can prove a message it holds is committed to a checkpoint root |
| 55 | // it already trusts. The Go test pins these byte-for-byte against the same |
| 56 | // leaves — if either drifts, the platforms disagree about a valid proof. |
| 57 | |
| 58 | async function sha256bytes(bytes) { |
| 59 | return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)); |
| 60 | } |
| 61 | function hexToBytes(hex) { |
| 62 | const out = new Uint8Array(hex.length / 2); |
| 63 | for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16); |
| 64 | return out; |
| 65 | } |
| 66 | function bytesToHex(bytes) { |
| 67 | return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join(""); |
| 68 | } |
| 69 | |
| 70 | // leafHashHex mirrors journalLeafHash — the domain-separated hash of a journal |
| 71 | // row, the tree's leaf. Field order is wire format (checkpoint.go). |
| 72 | export async function leafHashHex(row) { |
| 73 | const enc = LEAF_DOMAIN + row.seq + "\n" + row.ts + "\n" + row.kind + "\n" + |
| 74 | row.msg_id + "\n" + row.blob_hash + "\n" + row.thread_id; |
| 75 | return bytesToHex(await sha256bytes(new TextEncoder().encode(enc))); |
| 76 | } |
| 77 | |
| 78 | async function nodeHashBytes(l, r) { |
| 79 | const buf = new Uint8Array(NODE_DOMAIN.length + 64); |
| 80 | buf.set(new TextEncoder().encode(NODE_DOMAIN), 0); |
| 81 | buf.set(l, NODE_DOMAIN.length); |
| 82 | buf.set(r, NODE_DOMAIN.length + 32); |
| 83 | return sha256bytes(buf); |
| 84 | } |
| 85 | |
| 86 | // rootFromAuditPath recomputes the Merkle root from a leaf (hex), its index m |
| 87 | // in a tree of n leaves, and its audit path (hex sibling hashes, bottom-up) — |
| 88 | // the exact mirror of checkpoint.go's rootFromAuditPath. Returns the root hex, |
| 89 | // or null on a malformed proof (wrong path length, out-of-range index). |
| 90 | export async function rootFromAuditPath(leafHex, m, n, pathHex) { |
| 91 | if (m < 0 || m >= n) return null; |
| 92 | const path = pathHex.map(hexToBytes); |
| 93 | async function recompute(leaf, m, n, path) { |
| 94 | if (n === 1) return path.length === 0 ? leaf : null; |
| 95 | if (path.length === 0) return null; |
| 96 | let k = 1; |
| 97 | while (k * 2 < n) k *= 2; |
| 98 | const sibling = path[path.length - 1]; |
| 99 | const rest = path.slice(0, -1); |
| 100 | if (m < k) { |
| 101 | const left = await recompute(leaf, m, k, rest); |
| 102 | return left && (await nodeHashBytes(left, sibling)); |
| 103 | } |
| 104 | const right = await recompute(leaf, m - k, n - k, rest); |
| 105 | return right && (await nodeHashBytes(sibling, right)); |
| 106 | } |
| 107 | const root = await recompute(hexToBytes(leafHex), m, n, path); |
| 108 | return root && bytesToHex(root); |
| 109 | } |
| 110 | |
| 111 | // verifyInclusion checks one proof: recompute the leaf from its row fields, |
| 112 | // walk the audit path, and confirm it reaches the proof's stated root. Returns |
| 113 | // { ok, root } — ok true only if the recomputed root matches proof.root. The |
| 114 | // caller separately checks proof.root is a root it TRUSTS (verified via the |
| 115 | // signed chain); this function only proves the leaf is in that root's tree. |
| 116 | export async function verifyInclusion(proof) { |
| 117 | const leaf = await leafHashHex({ |
| 118 | seq: proof.seq, ts: proof.ts, kind: proof.kind, msg_id: proof.msg_id, |
| 119 | blob_hash: proof.blob_hash, thread_id: proof.thread_id, |
| 120 | }); |
| 121 | const root = await rootFromAuditPath(leaf, proof.leaf_index, proof.tree_size, proof.audit_path || []); |
| 122 | return { ok: root != null && root === proof.root, root }; |
| 123 | } |
| 124 | |
| 125 | function stdB64ToBytes(b64) { |
| 126 | const bin = atob(b64); |
| 127 | const out = new Uint8Array(bin.length); |
| 128 | for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i); |
| 129 | return out; |
| 130 | } |
| 131 | |
| 132 | // ed25519Verify checks one signature, returning false (never throwing) on any |
| 133 | // malformed input. Returns null when this environment's WebCrypto lacks |
| 134 | // Ed25519 — hash and linkage checks still run, signatures are recorded as |
| 135 | // unverified (see /integrity's report). Keys are cached per pub so a page of |
| 136 | // checkpoints doesn't re-import per row. |
| 137 | const keyCache = new Map(); |
| 138 | export async function ed25519Available() { |
| 139 | try { |
| 140 | await crypto.subtle.importKey("raw", new Uint8Array(32), { name: "Ed25519" }, false, ["verify"]); |
| 141 | return true; |
| 142 | } catch { |
| 143 | return false; |
| 144 | } |
| 145 | } |
| 146 | async function ed25519Verify(pubB64, payloadStr, sigB64) { |
| 147 | try { |
| 148 | let key = keyCache.get(pubB64); |
| 149 | if (!key) { |
| 150 | key = await crypto.subtle.importKey("raw", stdB64ToBytes(pubB64), { name: "Ed25519" }, false, ["verify"]); |
| 151 | keyCache.set(pubB64, key); |
| 152 | } |
| 153 | return await crypto.subtle.verify("Ed25519", key, stdB64ToBytes(sigB64), new TextEncoder().encode(payloadStr)); |
| 154 | } catch { |
| 155 | return false; |
| 156 | } |
| 157 | } |
| 158 | |
| 159 | // verifyCheckpointPage walks one page of served checkpoints, extending prior |
| 160 | // (the last verified head, or null on first sync). Each checkpoint's payload |
| 161 | // names its own signing key: the chain of hashes is what holds history |
| 162 | // together, the signature is attribution — so a mid-chain key change is |
| 163 | // alerted (it's investigable: a restore, a rotation, or an attack) but the |
| 164 | // walk CONTINUES; only broken hashes/links/signatures stop it. Returns the |
| 165 | // new head, the verified (seqTo -> chain) boundary pairs, alerts, and whether |
| 166 | // the walk completed the page. |
| 167 | export async function verifyCheckpointPage({ checkpoints, prior, checkSigs }) { |
| 168 | const alerts = []; |
| 169 | const hist = []; |
| 170 | const roots = []; // verified checkpoint roots (for inclusion-proof trust) |
| 171 | let head = prior || null; |
| 172 | let pub = prior ? prior.pub : null; |
| 173 | for (const cp of checkpoints) { |
| 174 | let payload; |
| 175 | try { |
| 176 | const wrapper = JSON.parse(cp.signed); |
| 177 | payload = JSON.parse(new TextDecoder().decode(stdB64ToBytes(wrapper.payload))); |
| 178 | if (typeof payload.pub !== "string" || !payload.pub) throw new Error("no pub"); |
| 179 | if (checkSigs && !(await ed25519Verify(payload.pub, wrapper.payload, wrapper.sig))) { |
| 180 | alerts.push({ kind: "bad-signature", id: cp.id }); |
| 181 | break; |
| 182 | } |
| 183 | } catch { |
| 184 | alerts.push({ kind: "malformed", id: cp.id }); |
| 185 | break; |
| 186 | } |
| 187 | if ((await chainHashHex(payload.prev_chain, payload.root, payload.seq_to)) !== payload.chain) { |
| 188 | alerts.push({ kind: "bad-chain-hash", id: cp.id }); |
| 189 | break; |
| 190 | } |
| 191 | if (payload.prev_chain !== (head ? head.chain : "")) { |
| 192 | alerts.push({ kind: "broken-link", id: cp.id, seqTo: payload.seq_to }); |
| 193 | break; |
| 194 | } |
| 195 | if (head && payload.seq_from !== head.seqTo + 1) { |
| 196 | alerts.push({ kind: "gap", id: cp.id, seqFrom: payload.seq_from, after: head.seqTo }); |
| 197 | break; |
| 198 | } |
| 199 | if (cp.seq_to !== payload.seq_to || cp.chain !== payload.chain) { |
| 200 | alerts.push({ kind: "row-drift", id: cp.id }); |
| 201 | break; |
| 202 | } |
| 203 | if (pub && payload.pub !== pub) { |
| 204 | // Legitimate-but-investigable (restore from a pre-key backup, deliberate |
| 205 | // rotation) — alert once, keep verifying under the new key. |
| 206 | alerts.push({ kind: "key-change", id: cp.id, seqTo: payload.seq_to, keep: true }); |
| 207 | } |
| 208 | pub = payload.pub; |
| 209 | head = { id: cp.id, seqTo: payload.seq_to, chain: payload.chain, pub }; |
| 210 | hist.push([payload.seq_to, payload.chain]); |
| 211 | roots.push(payload.root); // root is chain-hash-bound above, so trusting it is sound |
| 212 | } |
| 213 | const fatal = alerts.some((a) => !a.keep); |
| 214 | return { head, hist, roots, alerts, fatal }; |
| 215 | } |
| 216 | |
| 217 | // gossipVerdict compares a peer's gossiped head [seqTo, chain] against our |
| 218 | // verified head + bounded boundary history. Checkpoint boundaries are global |
| 219 | // (one checkpoints table per instance), so within our kept window a peer |
| 220 | // boundary we don't have at all is a fork, exactly like a chain mismatch at a |
| 221 | // shared boundary. Below the window there's genuinely no verdict. |
| 222 | export function gossipVerdict(head, hist, gossip) { |
| 223 | if (!Array.isArray(gossip) || gossip.length !== 2) return "none"; |
| 224 | const [s, c] = gossip; |
| 225 | if (typeof s !== "number" || typeof c !== "string") return "none"; |
| 226 | if (!head) return "no-head"; |
| 227 | if (s > head.seqTo) return "ahead"; |
| 228 | if (s === head.seqTo) return c === head.chain ? "match" : "fork"; |
| 229 | const floor = hist.length ? hist[0][0] : head.seqTo; |
| 230 | if (s < floor) return "unknown-old"; |
| 231 | const ours = hist.find((h) => h[0] === s); |
| 232 | if (!ours) return "fork"; // inside our window but not one of our boundaries |
| 233 | return ours[1] === c ? "match" : "fork"; |
| 234 | } |
| 235 | |
| 236 | // createIntegrity wires the pure core to storage + network. `store` is any |
| 237 | // object with getItem/setItem (localStorage in the shell, a Map-backed fake |
| 238 | // in tests); `fetchPage(afterID)` returns the parsed /api/checkpoints |
| 239 | // response; `now()` defaults to Date.now. The shell calls poll() on connect + |
| 240 | // a slow interval, gossipOut() when sending, gossipIn() when receiving |
| 241 | // (live and history alike). |
| 242 | // |
| 243 | // Concurrency: several tabs/webviews share the storage key, and gossipIn can |
| 244 | // interleave with a long-running poll in the same tab. Alerts — the part that |
| 245 | // must never be lost — are appended with a fresh read-modify-write at record |
| 246 | // time; poll's final save re-reads and merges so it can't clobber alerts or a |
| 247 | // newer pending recorded mid-flight. head/hist are last-writer-wins on |
| 248 | // purpose: every writer verified them against the same server, so they |
| 249 | // converge. |
| 250 | export function createIntegrity({ store, fetchPage, now = () => Date.now(), key = "lchat_ckpt", onAlert }) { |
| 251 | const blank = () => ({ v: 1, head: null, hist: [], alerts: [], stats: {} }); |
| 252 | const load = () => { |
| 253 | try { |
| 254 | return { ...blank(), ...(JSON.parse(store.getItem(key) || "null") || {}) }; |
| 255 | } catch { |
| 256 | return blank(); |
| 257 | } |
| 258 | }; |
| 259 | const save = (st) => store.setItem(key, JSON.stringify(st)); |
| 260 | const sameAlert = (a, b) => a.kind === b.kind && a.seqTo === b.seqTo && a.id === b.id; |
| 261 | // addAlert persists immediately against fresh state (one alert per |
| 262 | // kind+location — a persistent condition must not spam), then mirrors into |
| 263 | // the caller's working copy. |
| 264 | const addAlert = (st, a) => { |
| 265 | const fresh = load(); |
| 266 | let added = false; |
| 267 | if (!fresh.alerts.some((x) => sameAlert(x, a))) { |
| 268 | fresh.alerts = fresh.alerts.slice(-(ALERTS_KEEP - 1)).concat([{ ...a, at: now() }]); |
| 269 | save(fresh); |
| 270 | console.warn("integrity:", a.kind, a); |
| 271 | added = true; |
| 272 | } |
| 273 | st.alerts = fresh.alerts; |
| 274 | // Fire the host hook (renders the failure banner) only for a genuinely new |
| 275 | // alert, so a persistent condition re-detected every poll doesn't re-nag. |
| 276 | if (added && onAlert) { try { onAlert(a); } catch {} } |
| 277 | }; |
| 278 | |
| 279 | return { |
| 280 | // poll fetches everything past our head and verifies it. The first page |
| 281 | // re-fetches the head row itself (after = head.id - 1) so a served chain |
| 282 | // that no longer contains our verified head — a rollback — is caught, not |
| 283 | // mistaken for silence. Network failures are silent (next poll retries); |
| 284 | // verification failures alert and stop; malformed rows alert, never throw. |
| 285 | async poll() { |
| 286 | const st = load(); |
| 287 | let pages = 0; |
| 288 | let first = true; |
| 289 | let caughtUp = false; |
| 290 | try { |
| 291 | if (st.sigOk === undefined) st.sigOk = await ed25519Available(); |
| 292 | while (pages++ < 50) { |
| 293 | let r; |
| 294 | try { |
| 295 | r = await fetchPage(st.head ? st.head.id - (first ? 1 : 0) : 0); |
| 296 | } catch { |
| 297 | return; // offline — nothing to conclude |
| 298 | } |
| 299 | if (!r || !Array.isArray(r.checkpoints)) return; |
| 300 | const rawLen = r.checkpoints.length; |
| 301 | let cps = r.checkpoints; |
| 302 | if (st.head && first) { |
| 303 | const mine = cps.find((c) => c.id === st.head.id); |
| 304 | if (!mine || mine.seq_to !== st.head.seqTo || mine.chain !== st.head.chain) { |
| 305 | addAlert(st, { kind: "rollback", id: st.head.id, seqTo: st.head.seqTo }); |
| 306 | return; |
| 307 | } |
| 308 | cps = cps.filter((c) => c.id > st.head.id); |
| 309 | } |
| 310 | first = false; |
| 311 | if (cps.length) { |
| 312 | const out = await verifyCheckpointPage({ checkpoints: cps, prior: st.head, checkSigs: st.sigOk }); |
| 313 | for (const a of out.alerts) addAlert(st, a); |
| 314 | if (out.head) st.head = out.head; |
| 315 | st.hist = st.hist.concat(out.hist).slice(-HIST_KEEP); |
| 316 | st.roots = (st.roots || []).concat(out.roots || []).slice(-ROOTS_KEEP); |
| 317 | if (out.fatal) return; |
| 318 | } |
| 319 | if (rawLen < PAGE_SIZE) { |
| 320 | caughtUp = true; |
| 321 | break; |
| 322 | } |
| 323 | } |
| 324 | // A pending "ahead" gossip resolves once our verified head reaches its |
| 325 | // seq: matching boundary → clean; mismatched or MISSING boundary → |
| 326 | // fork (boundaries are global). Unresolved past the grace window with |
| 327 | // catch-up complete → the server is withholding from us what a peer |
| 328 | // already verified. Never judged mid-catch-up (the page cap) — a |
| 329 | // device far behind isn't being withheld from, it's just behind. |
| 330 | if (st.pending && st.head && st.head.seqTo >= st.pending.s) { |
| 331 | if (gossipVerdict(st.head, st.hist, [st.pending.s, st.pending.c]) === "fork") { |
| 332 | addAlert(st, { kind: "gossip-fork", seqTo: st.pending.s }); |
| 333 | } |
| 334 | st.pendingDone = st.pending; |
| 335 | st.pending = null; |
| 336 | } else if (st.pending && caughtUp && now() - st.pending.at > AHEAD_GRACE_MS) { |
| 337 | addAlert(st, { kind: "withheld", seqTo: st.pending.s }); |
| 338 | st.pendingDone = st.pending; |
| 339 | st.pending = null; |
| 340 | } |
| 341 | st.stats.lastPollAt = now(); |
| 342 | } finally { |
| 343 | // Merge over fresh state: alerts and gossip stats recorded mid-flight |
| 344 | // (this tab's gossipIn, another tab's poll) must survive this save. |
| 345 | const fresh = load(); |
| 346 | for (const a of fresh.alerts) if (!st.alerts.some((x) => sameAlert(x, a))) st.alerts.push(a); |
| 347 | st.alerts = st.alerts.slice(-ALERTS_KEEP); |
| 348 | if (!st.head || (fresh.head && fresh.head.seqTo > st.head.seqTo)) { |
| 349 | st.head = fresh.head; |
| 350 | st.hist = fresh.hist; |
| 351 | } |
| 352 | if (fresh.stats.gossipSeen > (st.stats.gossipSeen || 0)) st.stats.gossipSeen = fresh.stats.gossipSeen; |
| 353 | if (fresh.stats.gossipMatch > (st.stats.gossipMatch || 0)) st.stats.gossipMatch = fresh.stats.gossipMatch; |
| 354 | // Keep a pending another writer set mid-flight — unless this poll just |
| 355 | // resolved that very one. |
| 356 | if (!st.pending && fresh.pending && !(st.pendingDone && fresh.pending.at === st.pendingDone.at)) { |
| 357 | st.pending = fresh.pending; |
| 358 | } |
| 359 | delete st.pendingDone; |
| 360 | save(st); |
| 361 | } |
| 362 | }, |
| 363 | |
| 364 | // gossipOut returns the `_ckpt` value for an outgoing payload (or null |
| 365 | // before the first verified head). |
| 366 | gossipOut() { |
| 367 | const st = load(); |
| 368 | return st.head ? [st.head.seqTo, st.head.chain] : null; |
| 369 | }, |
| 370 | |
| 371 | // gossipIn folds a peer's `_ckpt` from a decrypted incoming payload — |
| 372 | // live or history; the host chooses which path a message arrives by, so |
| 373 | // both must count as evidence. `countPeer` guards the stats (own echoes |
| 374 | // and history refolds shouldn't inflate "peer heads compared"). |
| 375 | gossipIn(gossip, { countPeer = true } = {}) { |
| 376 | const st = load(); |
| 377 | const v = gossipVerdict(st.head, st.hist, gossip); |
| 378 | if (countPeer && (v === "match" || v === "fork" || v === "ahead")) { |
| 379 | st.stats.gossipSeen = (st.stats.gossipSeen || 0) + 1; |
| 380 | if (v === "match") st.stats.gossipMatch = (st.stats.gossipMatch || 0) + 1; |
| 381 | } |
| 382 | if (v === "fork") addAlert(st, { kind: "gossip-fork", seqTo: gossip[0] }); |
| 383 | if (v === "ahead" && (!st.pending || gossip[0] > st.pending.s)) { |
| 384 | st.pending = { s: gossip[0], c: gossip[1], at: st.pending ? st.pending.at : now() }; |
| 385 | } |
| 386 | save(st); |
| 387 | return v; |
| 388 | }, |
| 389 | |
| 390 | // sampleAndVerify proves a handful of messages the client HOLDS are |
| 391 | // committed to the chain (docs/tamper-evidence.md client sampling). For |
| 392 | // each {msgId, blobHash} sample, fetch its inclusion proofs and check them |
| 393 | // against roots we verified via the signed chain. Sound + false-alarm-free: |
| 394 | // • a proof against a trusted root whose audit path DOESN'T recompute → |
| 395 | // the server forged it → "bad-proof" alert (unambiguous). |
| 396 | // • a proof against a trusted root that matches our held ciphertext → |
| 397 | // that message is provably committed (counted). |
| 398 | // • no matching proof → NOT alarmed (could be too recent to checkpoint); |
| 399 | // the negative "committed-but-different" case needs seq-horizon care |
| 400 | // and is a deliberate follow-up. |
| 401 | // `fetchProof(msgId)` returns the /api/checkpoint-proof body. |
| 402 | async sampleAndVerify(samples, fetchProof) { |
| 403 | const st = load(); |
| 404 | const trusted = new Set(st.roots || []); |
| 405 | if (!trusted.size) return; // nothing verified to check against yet |
| 406 | let checked = 0, verified = 0; |
| 407 | for (const { msgId, blobHash } of samples) { |
| 408 | let resp; |
| 409 | try { |
| 410 | resp = await fetchProof(msgId); |
| 411 | } catch { |
| 412 | continue; // offline — no conclusion |
| 413 | } |
| 414 | if (!resp || !Array.isArray(resp.proofs)) continue; |
| 415 | checked++; |
| 416 | for (const proof of resp.proofs) { |
| 417 | if (!trusted.has(proof.root)) continue; // a checkpoint we haven't verified; skip |
| 418 | const { ok } = await verifyInclusion(proof); |
| 419 | if (!ok) { |
| 420 | addAlert(st, { kind: "bad-proof", seqTo: proof.seq }); |
| 421 | continue; |
| 422 | } |
| 423 | if (proof.blob_hash === blobHash) verified++; |
| 424 | } |
| 425 | } |
| 426 | st.stats.sampleChecked = (st.stats.sampleChecked || 0) + checked; |
| 427 | st.stats.sampleVerified = (st.stats.sampleVerified || 0) + verified; |
| 428 | save(st); |
| 429 | return { checked, verified }; |
| 430 | }, |
| 431 | |
| 432 | // recordAlert lets other subsystems (e.g. key-transparency bind-MAC |
| 433 | // verification in shell.js) file an integrity alert through the same |
| 434 | // deduped, banner-raising path the chain checks use. `key` distinguishes |
| 435 | // instances of the same kind (e.g. a user id) so re-checking the same |
| 436 | // member doesn't spam. |
| 437 | recordAlert(kind, key) { |
| 438 | const st = load(); |
| 439 | // `id` is the dedup discriminator (alertKey/sameAlert), so keying by e.g. |
| 440 | // a user id means re-checking the same member doesn't re-file. |
| 441 | addAlert(st, { kind, seqTo: undefined, id: key }); |
| 442 | save(st); |
| 443 | }, |
| 444 | |
| 445 | // state powers the /integrity command's private reply. |
| 446 | state() { |
| 447 | return load(); |
| 448 | }, |
| 449 | |
| 450 | // unresolvedAlerts returns alerts the member hasn't dismissed yet — what |
| 451 | // the failure banner shows. Acknowledged alerts stay in the record (for |
| 452 | // /integrity and this device's evidence) but don't re-raise the banner. |
| 453 | unresolvedAlerts() { |
| 454 | const st = load(); |
| 455 | const acked = st.acked || []; |
| 456 | return st.alerts.filter((a) => !acked.some((k) => k === alertKey(a))); |
| 457 | }, |
| 458 | |
| 459 | // acknowledge dismisses every current alert from the banner. A LATER, |
| 460 | // different alert (new kind or new seq) is not covered, so it re-raises. |
| 461 | acknowledge() { |
| 462 | const st = load(); |
| 463 | st.acked = [...new Set((st.acked || []).concat(st.alerts.map(alertKey)))].slice(-ALERTS_KEEP * 2); |
| 464 | save(st); |
| 465 | }, |
| 466 | }; |
| 467 | } |
| 468 | |
| 469 | // alertKey identifies an alert for de-dup + acknowledgement (kind + location). |
| 470 | function alertKey(a) { |
| 471 | return `${a.kind}:${a.seqTo ?? a.id ?? ""}`; |
| 472 | } |
| 473 | |
amadan