feat: persistent storage — SQLite backends for crash resilience
Shade sessions and keys now survive server crashes, container restarts, and power outages via SQLite with WAL mode. New packages: - @shade/storage-sqlite: SQLiteStorage (StorageProvider) + SqlitePrekeyStore (PrekeyStore), both using bun:sqlite with auto-created tables and WAL mode - Serialization layer in shade-core for SessionState/keys ↔ JSON/base64 Docker usage: mount volume at /data, set SHADE_DB_PATH=/data/shade-client.db Prekey server auto-detects SHADE_PREKEY_DB_PATH for SQLite persistence Includes crash recovery integration test: encrypt → close DB → reopen → conversation continues seamlessly. 129 tests, 0 failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
2
packages/shade-storage-sqlite/src/index.ts
Normal file
2
packages/shade-storage-sqlite/src/index.ts
Normal file
@@ -0,0 +1,2 @@
|
||||
export { SQLiteStorage } from './sqlite-storage.js';
|
||||
export { SqlitePrekeyStore } from './sqlite-prekey-store.js';
|
||||
138
packages/shade-storage-sqlite/src/sqlite-prekey-store.ts
Normal file
138
packages/shade-storage-sqlite/src/sqlite-prekey-store.ts
Normal file
@@ -0,0 +1,138 @@
|
||||
import { Database } from 'bun:sqlite';
|
||||
import type { PrekeyStore } from '@shade/server/src/store.js';
|
||||
import { toBase64, fromBase64 } from '@shade/core';
|
||||
|
||||
/**
|
||||
* SQLite-backed PrekeyStore for the Shade Prekey Server.
|
||||
*
|
||||
* Stores PUBLIC keys only (never private keys). Used by the prekey server
|
||||
* Docker container to persist registered identities and prekey bundles.
|
||||
*
|
||||
* Docker usage:
|
||||
* Volume mount /data, set SHADE_PREKEY_DB_PATH=/data/shade-prekeys.db
|
||||
*/
|
||||
export class SqlitePrekeyStore implements PrekeyStore {
|
||||
private db: Database;
|
||||
|
||||
private stmts!: {
|
||||
saveIdentity: ReturnType<Database['prepare']>;
|
||||
getIdentity: ReturnType<Database['prepare']>;
|
||||
saveSignedPreKey: ReturnType<Database['prepare']>;
|
||||
getSignedPreKey: ReturnType<Database['prepare']>;
|
||||
insertOTPK: ReturnType<Database['prepare']>;
|
||||
consumeOTPK: ReturnType<Database['prepare']>;
|
||||
countOTPK: ReturnType<Database['prepare']>;
|
||||
deleteIdentity: ReturnType<Database['prepare']>;
|
||||
deleteSignedPreKey: ReturnType<Database['prepare']>;
|
||||
deleteOTPKs: ReturnType<Database['prepare']>;
|
||||
};
|
||||
|
||||
constructor(dbPath?: string) {
|
||||
const path = dbPath ?? process.env.SHADE_PREKEY_DB_PATH ?? '/data/shade-prekeys.db';
|
||||
this.db = new Database(path, { create: true });
|
||||
this.db.exec('PRAGMA journal_mode=WAL');
|
||||
this.ensureTables();
|
||||
this.prepareStatements();
|
||||
}
|
||||
|
||||
private ensureTables() {
|
||||
this.db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS identities (
|
||||
address TEXT PRIMARY KEY,
|
||||
identity_signing_key TEXT NOT NULL,
|
||||
identity_dh_key TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS signed_prekeys (
|
||||
address TEXT PRIMARY KEY,
|
||||
key_id INTEGER NOT NULL,
|
||||
public_key TEXT NOT NULL,
|
||||
signature TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS one_time_prekeys (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
address TEXT NOT NULL,
|
||||
key_id INTEGER NOT NULL,
|
||||
public_key TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_otp_address ON one_time_prekeys(address);
|
||||
`);
|
||||
}
|
||||
|
||||
private prepareStatements() {
|
||||
this.stmts = {
|
||||
saveIdentity: this.db.prepare('INSERT OR REPLACE INTO identities (address, identity_signing_key, identity_dh_key) VALUES (?, ?, ?)'),
|
||||
getIdentity: this.db.prepare('SELECT identity_signing_key, identity_dh_key FROM identities WHERE address = ?'),
|
||||
saveSignedPreKey: this.db.prepare('INSERT OR REPLACE INTO signed_prekeys (address, key_id, public_key, signature) VALUES (?, ?, ?, ?)'),
|
||||
getSignedPreKey: this.db.prepare('SELECT key_id, public_key, signature FROM signed_prekeys WHERE address = ?'),
|
||||
insertOTPK: this.db.prepare('INSERT INTO one_time_prekeys (address, key_id, public_key) VALUES (?, ?, ?)'),
|
||||
consumeOTPK: this.db.prepare('DELETE FROM one_time_prekeys WHERE id = (SELECT id FROM one_time_prekeys WHERE address = ? ORDER BY id LIMIT 1) RETURNING key_id, public_key'),
|
||||
countOTPK: this.db.prepare('SELECT COUNT(*) as count FROM one_time_prekeys WHERE address = ?'),
|
||||
deleteIdentity: this.db.prepare('DELETE FROM identities WHERE address = ?'),
|
||||
deleteSignedPreKey: this.db.prepare('DELETE FROM signed_prekeys WHERE address = ?'),
|
||||
deleteOTPKs: this.db.prepare('DELETE FROM one_time_prekeys WHERE address = ?'),
|
||||
};
|
||||
}
|
||||
|
||||
close() {
|
||||
this.db.close();
|
||||
}
|
||||
|
||||
async saveIdentity(address: string, identitySigningKey: Uint8Array, identityDHKey: Uint8Array): Promise<void> {
|
||||
this.stmts.saveIdentity.run(address, toBase64(identitySigningKey), toBase64(identityDHKey));
|
||||
}
|
||||
|
||||
async getIdentity(address: string): Promise<{ identitySigningKey: Uint8Array; identityDHKey: Uint8Array } | null> {
|
||||
const row = this.stmts.getIdentity.get(address) as any;
|
||||
if (!row) return null;
|
||||
return {
|
||||
identitySigningKey: fromBase64(row.identity_signing_key),
|
||||
identityDHKey: fromBase64(row.identity_dh_key),
|
||||
};
|
||||
}
|
||||
|
||||
async saveSignedPreKey(address: string, keyId: number, publicKey: Uint8Array, signature: Uint8Array): Promise<void> {
|
||||
this.stmts.saveSignedPreKey.run(address, keyId, toBase64(publicKey), toBase64(signature));
|
||||
}
|
||||
|
||||
async getSignedPreKey(address: string): Promise<{ keyId: number; publicKey: Uint8Array; signature: Uint8Array } | null> {
|
||||
const row = this.stmts.getSignedPreKey.get(address) as any;
|
||||
if (!row) return null;
|
||||
return {
|
||||
keyId: row.key_id,
|
||||
publicKey: fromBase64(row.public_key),
|
||||
signature: fromBase64(row.signature),
|
||||
};
|
||||
}
|
||||
|
||||
async saveOneTimePreKeys(address: string, keys: Array<{ keyId: number; publicKey: Uint8Array }>): Promise<void> {
|
||||
const insertMany = this.db.transaction(() => {
|
||||
for (const k of keys) {
|
||||
this.stmts.insertOTPK.run(address, k.keyId, toBase64(k.publicKey));
|
||||
}
|
||||
});
|
||||
insertMany();
|
||||
}
|
||||
|
||||
async consumeOneTimePreKey(address: string): Promise<{ keyId: number; publicKey: Uint8Array } | null> {
|
||||
const row = this.stmts.consumeOTPK.get(address) as any;
|
||||
if (!row) return null;
|
||||
return {
|
||||
keyId: row.key_id,
|
||||
publicKey: fromBase64(row.public_key),
|
||||
};
|
||||
}
|
||||
|
||||
async getOneTimePreKeyCount(address: string): Promise<number> {
|
||||
const row = this.stmts.countOTPK.get(address) as any;
|
||||
return row.count;
|
||||
}
|
||||
|
||||
async deleteAll(address: string): Promise<void> {
|
||||
const deleteAllTx = this.db.transaction(() => {
|
||||
this.stmts.deleteIdentity.run(address);
|
||||
this.stmts.deleteSignedPreKey.run(address);
|
||||
this.stmts.deleteOTPKs.run(address);
|
||||
});
|
||||
deleteAllTx();
|
||||
}
|
||||
}
|
||||
202
packages/shade-storage-sqlite/src/sqlite-storage.ts
Normal file
202
packages/shade-storage-sqlite/src/sqlite-storage.ts
Normal file
@@ -0,0 +1,202 @@
|
||||
import { Database } from 'bun:sqlite';
|
||||
import type { StorageProvider, IdentityKeyPair, SignedPreKey, OneTimePreKey, SessionState } from '@shade/core';
|
||||
import {
|
||||
toBase64, fromBase64,
|
||||
serializeSessionState, deserializeSessionState,
|
||||
serializeSignedPreKey, deserializeSignedPreKey,
|
||||
serializeOneTimePreKey, deserializeOneTimePreKey,
|
||||
} from '@shade/core';
|
||||
|
||||
/**
|
||||
* SQLite-backed StorageProvider for Shade client-side key/session storage.
|
||||
*
|
||||
* Uses bun:sqlite (built-in, zero deps). Stores private keys — for trusted environments only.
|
||||
* WAL mode enabled for crash safety. Auto-creates tables on first use.
|
||||
*
|
||||
* Docker usage:
|
||||
* Volume mount /data, set SHADE_DB_PATH=/data/shade-client.db
|
||||
*/
|
||||
export class SQLiteStorage implements StorageProvider {
|
||||
private db: Database;
|
||||
|
||||
// Prepared statements
|
||||
private stmts!: {
|
||||
getIdentity: ReturnType<Database['prepare']>;
|
||||
saveIdentity: ReturnType<Database['prepare']>;
|
||||
getConfig: ReturnType<Database['prepare']>;
|
||||
saveConfig: ReturnType<Database['prepare']>;
|
||||
getSignedPreKey: ReturnType<Database['prepare']>;
|
||||
saveSignedPreKey: ReturnType<Database['prepare']>;
|
||||
removeSignedPreKey: ReturnType<Database['prepare']>;
|
||||
getOneTimePreKey: ReturnType<Database['prepare']>;
|
||||
saveOneTimePreKey: ReturnType<Database['prepare']>;
|
||||
removeOneTimePreKey: ReturnType<Database['prepare']>;
|
||||
countOneTimePreKeys: ReturnType<Database['prepare']>;
|
||||
getSession: ReturnType<Database['prepare']>;
|
||||
saveSession: ReturnType<Database['prepare']>;
|
||||
removeSession: ReturnType<Database['prepare']>;
|
||||
getTrust: ReturnType<Database['prepare']>;
|
||||
saveTrust: ReturnType<Database['prepare']>;
|
||||
};
|
||||
|
||||
constructor(dbPath?: string) {
|
||||
const path = dbPath ?? process.env.SHADE_DB_PATH ?? '/data/shade-client.db';
|
||||
this.db = new Database(path, { create: true });
|
||||
this.db.exec('PRAGMA journal_mode=WAL');
|
||||
this.ensureTables();
|
||||
this.prepareStatements();
|
||||
}
|
||||
|
||||
private ensureTables() {
|
||||
this.db.exec(`
|
||||
CREATE TABLE IF NOT EXISTS identity (
|
||||
id INTEGER PRIMARY KEY CHECK (id = 1),
|
||||
signing_public_key TEXT NOT NULL,
|
||||
signing_private_key TEXT NOT NULL,
|
||||
dh_public_key TEXT NOT NULL,
|
||||
dh_private_key TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS config (
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS signed_prekeys (
|
||||
key_id INTEGER PRIMARY KEY,
|
||||
data_json TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS one_time_prekeys (
|
||||
key_id INTEGER PRIMARY KEY,
|
||||
data_json TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS sessions (
|
||||
address TEXT PRIMARY KEY,
|
||||
state_json TEXT NOT NULL
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS trusted_identities (
|
||||
address TEXT PRIMARY KEY,
|
||||
identity_key TEXT NOT NULL
|
||||
);
|
||||
`);
|
||||
}
|
||||
|
||||
private prepareStatements() {
|
||||
this.stmts = {
|
||||
getIdentity: this.db.prepare('SELECT * FROM identity WHERE id = 1'),
|
||||
saveIdentity: this.db.prepare('INSERT OR REPLACE INTO identity (id, signing_public_key, signing_private_key, dh_public_key, dh_private_key) VALUES (1, ?, ?, ?, ?)'),
|
||||
getConfig: this.db.prepare('SELECT value FROM config WHERE key = ?'),
|
||||
saveConfig: this.db.prepare('INSERT OR REPLACE INTO config (key, value) VALUES (?, ?)'),
|
||||
getSignedPreKey: this.db.prepare('SELECT data_json FROM signed_prekeys WHERE key_id = ?'),
|
||||
saveSignedPreKey: this.db.prepare('INSERT OR REPLACE INTO signed_prekeys (key_id, data_json) VALUES (?, ?)'),
|
||||
removeSignedPreKey: this.db.prepare('DELETE FROM signed_prekeys WHERE key_id = ?'),
|
||||
getOneTimePreKey: this.db.prepare('SELECT data_json FROM one_time_prekeys WHERE key_id = ?'),
|
||||
saveOneTimePreKey: this.db.prepare('INSERT OR REPLACE INTO one_time_prekeys (key_id, data_json) VALUES (?, ?)'),
|
||||
removeOneTimePreKey: this.db.prepare('DELETE FROM one_time_prekeys WHERE key_id = ?'),
|
||||
countOneTimePreKeys: this.db.prepare('SELECT COUNT(*) as count FROM one_time_prekeys'),
|
||||
getSession: this.db.prepare('SELECT state_json FROM sessions WHERE address = ?'),
|
||||
saveSession: this.db.prepare('INSERT OR REPLACE INTO sessions (address, state_json) VALUES (?, ?)'),
|
||||
removeSession: this.db.prepare('DELETE FROM sessions WHERE address = ?'),
|
||||
getTrust: this.db.prepare('SELECT identity_key FROM trusted_identities WHERE address = ?'),
|
||||
saveTrust: this.db.prepare('INSERT OR REPLACE INTO trusted_identities (address, identity_key) VALUES (?, ?)'),
|
||||
};
|
||||
}
|
||||
|
||||
close() {
|
||||
this.db.close();
|
||||
}
|
||||
|
||||
// ─── Identity ──────────────────────────────────────────────
|
||||
|
||||
async getIdentityKeyPair(): Promise<IdentityKeyPair | null> {
|
||||
const row = this.stmts.getIdentity.get() as any;
|
||||
if (!row) return null;
|
||||
return {
|
||||
signingPublicKey: fromBase64(row.signing_public_key),
|
||||
signingPrivateKey: fromBase64(row.signing_private_key),
|
||||
dhPublicKey: fromBase64(row.dh_public_key),
|
||||
dhPrivateKey: fromBase64(row.dh_private_key),
|
||||
};
|
||||
}
|
||||
|
||||
async saveIdentityKeyPair(kp: IdentityKeyPair): Promise<void> {
|
||||
this.stmts.saveIdentity.run(
|
||||
toBase64(kp.signingPublicKey),
|
||||
toBase64(kp.signingPrivateKey),
|
||||
toBase64(kp.dhPublicKey),
|
||||
toBase64(kp.dhPrivateKey),
|
||||
);
|
||||
}
|
||||
|
||||
async getLocalRegistrationId(): Promise<number> {
|
||||
const row = this.stmts.getConfig.get('registrationId') as any;
|
||||
return row ? parseInt(row.value, 10) : 0;
|
||||
}
|
||||
|
||||
async saveLocalRegistrationId(id: number): Promise<void> {
|
||||
this.stmts.saveConfig.run('registrationId', String(id));
|
||||
}
|
||||
|
||||
// ─── Signed PreKeys ───────────────────────────────────────
|
||||
|
||||
async getSignedPreKey(keyId: number): Promise<SignedPreKey | null> {
|
||||
const row = this.stmts.getSignedPreKey.get(keyId) as any;
|
||||
if (!row) return null;
|
||||
return deserializeSignedPreKey(row.data_json);
|
||||
}
|
||||
|
||||
async saveSignedPreKey(key: SignedPreKey): Promise<void> {
|
||||
this.stmts.saveSignedPreKey.run(key.keyId, serializeSignedPreKey(key));
|
||||
}
|
||||
|
||||
async removeSignedPreKey(keyId: number): Promise<void> {
|
||||
this.stmts.removeSignedPreKey.run(keyId);
|
||||
}
|
||||
|
||||
// ─── One-Time PreKeys ─────────────────────────────────────
|
||||
|
||||
async getOneTimePreKey(keyId: number): Promise<OneTimePreKey | null> {
|
||||
const row = this.stmts.getOneTimePreKey.get(keyId) as any;
|
||||
if (!row) return null;
|
||||
return deserializeOneTimePreKey(row.data_json);
|
||||
}
|
||||
|
||||
async saveOneTimePreKey(key: OneTimePreKey): Promise<void> {
|
||||
this.stmts.saveOneTimePreKey.run(key.keyId, serializeOneTimePreKey(key));
|
||||
}
|
||||
|
||||
async removeOneTimePreKey(keyId: number): Promise<void> {
|
||||
this.stmts.removeOneTimePreKey.run(keyId);
|
||||
}
|
||||
|
||||
async getOneTimePreKeyCount(): Promise<number> {
|
||||
const row = this.stmts.countOneTimePreKeys.get() as any;
|
||||
return row.count;
|
||||
}
|
||||
|
||||
// ─── Sessions ─────────────────────────────────────────────
|
||||
|
||||
async getSession(address: string): Promise<SessionState | null> {
|
||||
const row = this.stmts.getSession.get(address) as any;
|
||||
if (!row) return null;
|
||||
return deserializeSessionState(row.state_json);
|
||||
}
|
||||
|
||||
async saveSession(address: string, state: SessionState): Promise<void> {
|
||||
this.stmts.saveSession.run(address, serializeSessionState(state));
|
||||
}
|
||||
|
||||
async removeSession(address: string): Promise<void> {
|
||||
this.stmts.removeSession.run(address);
|
||||
}
|
||||
|
||||
// ─── Trust ────────────────────────────────────────────────
|
||||
|
||||
async isTrustedIdentity(address: string, identityKey: Uint8Array): Promise<boolean> {
|
||||
const row = this.stmts.getTrust.get(address) as any;
|
||||
if (!row) return true; // TOFU
|
||||
return row.identity_key === toBase64(identityKey);
|
||||
}
|
||||
|
||||
async saveTrustedIdentity(address: string, identityKey: Uint8Array): Promise<void> {
|
||||
this.stmts.saveTrust.run(address, toBase64(identityKey));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user