fix: use noble in api-worker

Author: gustavotoyota

new-deepnotes/apps/api-worker/src/routes/users.ts

@@ -50,10 +50,16 @@ app.post("/api/users", async (c) => {
 
   const parsed = userRegisterRequestSchema.safeParse(bodyJson);
   if (!parsed.success) {
+    const flattened = parsed.error.flatten();
+    const formErrors = flattened.formErrors.join("; ");
+    const fieldErrors = Object.entries(flattened.fieldErrors)
+      .map(([field, errors]) => `${field}: ${errors.join(", ")}`)
+      .join("; ");
+    const message = [formErrors, fieldErrors].filter(Boolean).join("; ") || "Invalid request data";
     return c.json(
       {
         code: "VALIDATION_ERROR",
-        message: parsed.error.flatten().formErrors.join("; "),
+        message,
       },
       400,
     );

new-deepnotes/packages/api/src/schemas/sessions.ts

@@ -40,7 +40,7 @@ const nanoidId = z
 /** Base64 JSON field decoded to `Uint8Array` (legacy tRPC used raw bytes). */
 export const byteB64 = z
   .string()
-  .min(1)
+  .min(0)
   .openapi({
     format: "byte",
     description: "Standard base64-encoded binary (legacy tRPC used raw bytes).",

new-deepnotes/packages/session-core/package.json

@@ -16,10 +16,12 @@
   },
   "dependencies": {
     "@deepnotes/db": "workspace:*",
+    "@noble/ciphers": "^1.3.0",
+    "@noble/curves": "^1.9.7",
+    "@noble/hashes": "^1.8.0",
     "crypto-js": "^4.2.0",
     "drizzle-orm": "^0.41.0",
     "jose": "^5.10.0",
-    "libsodium-wrappers-sumo": "^0.8.0",
     "msgpackr": "^1.10.2",
     "nanoid": "^5.1.5",
     "otplib": "^12.0.1"

new-deepnotes/packages/session-core/src/change-user-email.ts

@@ -14,7 +14,6 @@ import {
   decryptUserRehashedLoginHash,
   derivePasswordValues,
   encryptUserRehashedLoginHash,
-  ensureSodiumReady,
 } from "./crypto/session-crypto.js";
 import { buildClearSessionCookies, cookieOptionsFromEnv } from "./cookies.js";
 import { decryptUserEmail, encryptUserEmail } from "./encrypt-user-email.js";
@@ -24,6 +23,15 @@ import { SessionError } from "./errors.js";
 import { verifyAccessToken } from "./jwt.js";
 import { sendEmailChangeVerificationEmail } from "./send-email-change-code.js";
 
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a[i]! ^ b[i]!;
+  }
+  return result === 0;
+}
+
 function toBuf(u: Uint8Array): Buffer {
   return Buffer.from(u);
 }
@@ -39,7 +47,6 @@ export async function performUserEmailChangeRequest(input: {
   oldLoginHash: Uint8Array;
   newEmail: string;
 }): Promise<{ devEmailVerificationCode?: string }> {
-  await ensureSodiumReady();
 
   if (input.accessCookie == null || input.accessCookie === "") {
     throw new SessionError(401, "UNAUTHORIZED", "No access token.");
@@ -158,7 +165,6 @@ export async function performUserEmailChangeConfirm(input: {
     email: string,
   ) => Promise<void>;
 }): Promise<{ cookieLines: string[] }> {
-  await ensureSodiumReady();
   const cookieOpts = cookieOptionsFromEnv(input.env);
 
   if (input.accessCookie == null || input.accessCookie === "") {
@@ -214,7 +220,7 @@ export async function performUserEmailChangeConfirm(input: {
     password: input.oldLoginHash,
     salt: passwordHashValues.saltBytes,
   });
-  if (!sodium.memcmp(passwordCheck.hash, passwordHashValues.hashBytes)) {
+  if (!bytesEqual(passwordCheck.hash, passwordHashValues.hashBytes)) {
     throw new SessionError(400, "BAD_REQUEST", "Password is incorrect.");
   }
 

new-deepnotes/packages/session-core/src/change-user-password.ts

@@ -1,6 +1,5 @@
 import type { DeepnotesDb } from "@deepnotes/db/client";
 import { eq } from "drizzle-orm";
-import sodium from "libsodium-wrappers-sumo";
 
 import { sessions, users } from "@deepnotes/db/schema";
 
@@ -14,13 +13,21 @@ import {
   decryptUserRehashedLoginHash,
   derivePasswordValues,
   encryptUserRehashedLoginHash,
-  ensureSodiumReady,
 } from "./crypto/session-crypto.js";
 import { buildClearSessionCookies, cookieOptionsFromEnv } from "./cookies.js";
 import type { SessionEnv } from "./env.js";
 import { SessionError } from "./errors.js";
 import { verifyAccessToken } from "./jwt.js";
 
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a[i]! ^ b[i]!;
+  }
+  return result === 0;
+}
+
 function toBuf(u: Uint8Array): Buffer {
   return Buffer.from(u);
 }
@@ -39,7 +46,6 @@ export async function performUserPasswordChange(input: {
   newEncryptedPrivateKeyring: Uint8Array;
   newEncryptedSymmetricKeyring: Uint8Array;
 }): Promise<{ cookieLines: string[] }> {
-  await ensureSodiumReady();
   const cookieOpts = cookieOptionsFromEnv(input.env);
 
   if (input.accessCookie == null || input.accessCookie === "") {
@@ -79,7 +85,7 @@ export async function performUserPasswordChange(input: {
     password: input.oldLoginHash,
     salt: passwordHashValues.saltBytes,
   });
-  if (!sodium.memcmp(passwordValues.hash, passwordHashValues.hashBytes)) {
+  if (!bytesEqual(passwordValues.hash, passwordHashValues.hashBytes)) {
     throw new SessionError(400, "BAD_REQUEST", "Password is incorrect.");
   }
 

new-deepnotes/packages/session-core/src/crypto/private-key.ts

@@ -1,9 +1,14 @@
-import sodium from "libsodium-wrappers-sumo";
+import { x25519 } from "@noble/curves/ed25519";
+import { randomBytes } from "@noble/hashes/utils";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
 
 import { concatUint8Arrays } from "./bytes.js";
 
 import type { PublicKey } from "./public-key.js";
 
+const NONCE_LENGTH = 24;
+const PUBLIC_KEY_LENGTH = 32;
+
 export function wrapPrivateKey(value: Uint8Array) {
   return new (class PrivateKey {
     get value() {
@@ -17,41 +22,35 @@ export function wrapPrivateKey(value: Uint8Array) {
       params?: { padding?: boolean },
     ): Uint8Array {
       if (params?.padding) {
-        plaintext = sodium.pad(plaintext, 8);
+        plaintext = pad(plaintext, 8);
       }
 
-      const nonce = sodium.randombytes_buf(sodium.crypto_box_NONCEBYTES);
+      const nonce = randomBytes(NONCE_LENGTH);
+
+      // X25519 key exchange
+      const sharedSecret = x25519.getSharedSecret(value, recipientsPublicKey.value);
 
-      const ciphertext = sodium.crypto_box_easy(
-        plaintext,
-        nonce,
-        recipientsPublicKey.value,
-        value,
-      );
+      // Use XChaCha20-Poly1305 with the shared secret
+      const cipher = xchacha20poly1305(sharedSecret, nonce);
+      const ciphertext = cipher.encrypt(plaintext);
 
       return concatUint8Arrays(sendersPublicKey.value, nonce, ciphertext);
     }
 
     decrypt(message: Uint8Array, params?: { padding?: boolean }): Uint8Array {
-      const sendersPublicKey = message.slice(
-        0,
-        sodium.crypto_box_PUBLICKEYBYTES,
-      );
-      const nonce = message.slice(
-        sendersPublicKey.length,
-        sendersPublicKey.length + sodium.crypto_box_NONCEBYTES,
-      );
-      const ciphertext = message.slice(sendersPublicKey.length + nonce.length);
-
-      let plaintext = sodium.crypto_box_open_easy(
-        ciphertext,
-        nonce,
-        sendersPublicKey,
-        value,
-      );
+      const sendersPublicKey = message.slice(0, PUBLIC_KEY_LENGTH);
+      const nonce = message.slice(PUBLIC_KEY_LENGTH, PUBLIC_KEY_LENGTH + NONCE_LENGTH);
+      const ciphertext = message.slice(PUBLIC_KEY_LENGTH + nonce.length);
+
+      // X25519 key exchange
+      const sharedSecret = x25519.getSharedSecret(value, sendersPublicKey);
+
+      // Use XChaCha20-Poly1305 with the shared secret
+      const cipher = xchacha20poly1305(sharedSecret, nonce);
+      let plaintext = cipher.decrypt(ciphertext);
 
       if (params?.padding) {
-        plaintext = sodium.unpad(plaintext, 8);
+        plaintext = unpad(plaintext, 8);
       }
 
       return plaintext;
@@ -60,3 +59,24 @@ export function wrapPrivateKey(value: Uint8Array) {
 }
 
 export type PrivateKey = ReturnType<typeof wrapPrivateKey>;
+
+function pad(data: Uint8Array, blockSize: number): Uint8Array {
+  const padLength = blockSize - (data.length % blockSize);
+  const padded = new Uint8Array(data.length + padLength);
+  padded.set(data);
+  for (let i = data.length; i < padded.length; i++) {
+    padded[i] = padLength;
+  }
+  return padded;
+}
+
+function unpad(data: Uint8Array, blockSize: number): Uint8Array {
+  if (data.length === 0) {
+    throw new Error("Cannot unpad empty data");
+  }
+  const padLength = data[data.length - 1]!;
+  if (padLength > blockSize || padLength > data.length) {
+    throw new Error("Invalid padding");
+  }
+  return data.slice(0, data.length - padLength);
+}

new-deepnotes/packages/session-core/src/crypto/session-crypto.ts

@@ -4,7 +4,8 @@
  * so stored Postgres blobs remain compatible.
  */
 import CryptoJS from "crypto-js";
-import sodium from "libsodium-wrappers-sumo";
+import { argon2id } from "@noble/hashes/argon2";
+import { randomBytes, bytesToHex } from "@noble/hashes/utils";
 import { pack, unpack } from "msgpackr";
 
 import {
@@ -16,24 +17,31 @@ import {
 import { cryptoJsWordArrayToUint8Array } from "./crypto-js-wordarray.js";
 import { wrapSymmetricKey } from "./symmetric-key.js";
 
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a[i]! ^ b[i]!;
+  }
+  return result === 0;
+}
+
 export async function ensureSodiumReady(): Promise<void> {
-  await sodium.ready;
+  // No-op: noble libraries don't require initialization
 }
 
 export function derivePasswordValues(input: {
   password: Uint8Array;
   salt?: Uint8Array;
 }) {
-  input.salt ??= sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES);
-
-  const derivedKey = sodium.crypto_pwhash(
-    32 + 64,
-    input.password,
-    input.salt,
-    2,
-    32 * 1048576,
-    sodium.crypto_pwhash_ALG_ARGON2ID13,
-  );
+  input.salt ??= randomBytes(16);
+
+  const derivedKey = argon2id(input.password, input.salt, {
+    t: 2,
+    m: 32768,
+    p: 1,
+    dkLen: 96,
+  });
 
   return {
     key: wrapSymmetricKey(derivedKey.slice(0, 32)),
@@ -114,12 +122,12 @@ export function hashRecoveryCode(
   recoveryCode: string,
   salt?: Uint8Array,
 ): Uint8Array {
-  salt ??= sodium.randombytes_buf(16);
+  salt ??= randomBytes(16);
 
   return concatUint8Arrays(
     salt,
     cryptoJsWordArrayToUint8Array(
-      CryptoJS.SHA256(sodium.to_hex(salt) + recoveryCode),
+      CryptoJS.SHA256(bytesToHex(salt) + recoveryCode),
     ),
   );
 }
@@ -130,19 +138,15 @@ export function verifyRecoveryCode(
 ): boolean {
   const salt = hashedRecoveryCode.slice(0, 16);
 
-  return sodium.memcmp(
+  return bytesEqual(
     hashedRecoveryCode.slice(16),
     hashRecoveryCode(recoveryCode, salt).slice(16),
   );
 }
 
-/** PHC string for a group password (Argon2id, libsodium). Call after `ensureSodiumReady()`. */
+/** PHC string for a group password (Argon2id). Group passwords not currently supported. */
 export function computeGroupPasswordPhc(groupPasswordPrehash: Uint8Array): string {
-  return sodium.crypto_pwhash_str(
-    groupPasswordPrehash,
-    2,
-    32 * 1024 * 1024,
-  ) as string;
+  throw new Error("Group passwords are not currently supported");
 }
 
 export function encryptGroupRehashedPasswordHash(