Files
featherChat/warzone/crates/warzone-server/src/routes/web.rs
Siavash Sameni f3e78c6cff Group chat with E2E encryption for both web and CLI clients
Server:
- POST /v1/groups/create — create named group
- POST /v1/groups/:name/join — join group
- GET /v1/groups/:name — get group info + member list
- GET /v1/groups — list all groups
- POST /v1/groups/:name/send — fan-out encrypted messages to members
- Groups stored in sled, members tracked by fingerprint

Web client:
- /gcreate <name> — create group
- /gjoin <name> — join group
- /g <name> — switch to group chat mode
- /glist — list all groups
- /dm — switch back to DM mode
- Group messages encrypted per-member (ECDH + AES-GCM for each)
- Group tag shown on received messages: "sender [groupname]"

CLI TUI client:
- Same commands: /gcreate, /gjoin, /g, /glist, /dm
- Group messages encrypted per-member (X3DH + Double Ratchet for each)
- Automatic X3DH key exchange with new group members on first message
- Sessions established and persisted per-member

Architecture:
- Client-side fan-out encryption: message encrypted N times (once per member)
- Server stores one copy per recipient in their message queue
- Reuses existing 1:1 encryption — no new crypto primitives needed
- Works for groups ≤ 50 members (per DESIGN.md)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 23:13:16 +04:00

535 lines
19 KiB
Rust

use axum::{
response::Html,
routing::get,
Router,
};
use crate::state::AppState;
pub fn routes() -> Router<AppState> {
Router::new().route("/", get(web_ui))
}
async fn web_ui() -> Html<&'static str> {
Html(WEB_HTML)
}
const WEB_HTML: &str = r##"<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=no,viewport-fit=cover">
<meta name="theme-color" content="#0a0a1a">
<title>Warzone</title>
<style>
* { box-sizing: border-box; margin: 0; padding: 0; }
html, body { height: 100%; overflow: hidden; }
body { background: #0a0a1a; color: #c8d6e5; font-family: 'JetBrains Mono', 'Fira Code', 'Courier New', monospace;
display: flex; flex-direction: column; height: 100dvh; font-size: 14px; }
/* Setup screen */
.screen { display: none; flex-direction: column; flex: 1; }
.screen.active { display: flex; }
#setup { align-items: center; justify-content: center; padding: 20px; }
#setup h1 { color: #e94560; font-size: 1.8em; margin-bottom: 4px; }
#setup .sub { color: #555; margin-bottom: 24px; font-size: 0.8em; }
.fp-display { background: #111; border: 1px solid #333; padding: 12px 20px; border-radius: 6px;
font-size: 1.1em; color: #4ade80; letter-spacing: 1px; margin: 8px 0; font-family: monospace;
user-select: all; cursor: pointer; }
.seed-display { background: #111; border: 1px solid #333; padding: 12px; border-radius: 6px;
margin: 8px 0; max-width: 420px; width: 100%; color: #e6a23c; font-size: 0.8em;
line-height: 1.8; text-align: center; user-select: all; word-break: break-all; }
.warn { color: #e94560; font-size: 0.75em; margin: 6px 0; }
.btn { padding: 10px 24px; background: #e94560; border: none; color: #fff; border-radius: 6px;
cursor: pointer; font-family: inherit; font-size: 0.9em; margin: 4px; }
.btn:hover { background: #c73e54; }
.btn-alt { background: #1a1a3e; border: 1px solid #444; }
.btn-alt:hover { background: #252550; }
#recover-area { display: none; margin-top: 12px; max-width: 420px; width: 100%; }
#recover-area textarea { width: 100%; padding: 10px; background: #1a1a2e; border: 1px solid #333;
color: #c8d6e5; border-radius: 6px; font-family: inherit; min-height: 50px;
resize: none; margin-bottom: 8px; font-size: 14px; }
/* Chat screen */
#chat-header { padding: 6px 10px; background: #111; border-bottom: 1px solid #222;
display: flex; align-items: center; gap: 8px; font-size: 0.8em; flex-wrap: wrap; }
#chat-header .tag { padding: 1px 6px; border-radius: 3px; font-size: 0.85em; }
.tag-fp { background: #0a2e0a; color: #4ade80; }
.tag-peer { background: #2e2e0a; color: #e6a23c; }
.tag-server { color: #444; }
#chat-header input { background: #1a1a2e; border: 1px solid #333; color: #e6a23c; padding: 2px 6px;
border-radius: 3px; font-family: inherit; font-size: 0.85em; width: 280px; }
#messages { flex: 1; overflow-y: auto; padding: 8px 10px; -webkit-overflow-scrolling: touch; }
.msg { padding: 2px 0; font-size: 0.85em; white-space: pre-wrap; word-wrap: break-word; }
.msg .ts { color: #333; margin-right: 4px; }
.msg .from-self { color: #4ade80; font-weight: bold; }
.msg .from-peer { color: #e6a23c; font-weight: bold; }
.msg .from-sys { color: #5e9ca0; font-style: italic; }
.msg .lock { color: #ff6b9d; }
#bottom { display: flex; padding: 6px; gap: 6px; border-top: 1px solid #222; background: #111;
align-items: flex-end; }
#msg-input { flex: 1; padding: 10px; background: #1a1a2e; border: 1px solid #333; color: #c8d6e5;
border-radius: 20px; font-family: inherit; font-size: 14px; resize: none;
min-height: 40px; max-height: 120px; line-height: 1.4; }
#send-btn { padding: 10px 16px; background: #e94560; border: none; color: #fff; border-radius: 20px;
cursor: pointer; font-size: 14px; min-height: 40px; }
#send-btn:hover { background: #c73e54; }
@media (max-width: 500px) {
.msg { font-size: 0.8em; }
#chat-header input { width: 180px; }
}
</style>
</head>
<body>
<!-- Setup screen -->
<div id="setup" class="screen active">
<h1>WARZONE</h1>
<div class="sub">end-to-end encrypted messenger</div>
<div id="gen-section">
<button class="btn" onclick="doGenerate()">Generate Identity</button>
<button class="btn btn-alt" onclick="document.getElementById('recover-area').style.display='block'">Recover</button>
<div id="recover-area">
<textarea id="recover-input" placeholder="Paste your hex seed (64 chars)..." rows="2"></textarea>
<button class="btn" onclick="doRecover()">Recover Identity</button>
</div>
</div>
<div id="id-section" style="display:none">
<div>Your fingerprint:</div>
<div class="fp-display" id="my-fp" title="Click to copy"></div>
<div class="seed-display" id="my-seed"></div>
<div class="warn">SAVE YOUR SEED — only way to recover your identity</div>
<br>
<button class="btn" onclick="enterChat()">Enter Chat</button>
</div>
</div>
<!-- Chat screen -->
<div id="chat" class="screen">
<div id="chat-header">
<span class="tag tag-fp" id="hdr-fp"></span>
<span>→</span>
<input id="peer-input" placeholder="Paste peer fingerprint..." autocomplete="off">
<span class="tag-server" id="hdr-server"></span>
</div>
<div id="messages"></div>
<div id="bottom">
<textarea id="msg-input" placeholder="Message... (Enter to send)" rows="1"></textarea>
<button id="send-btn" onclick="doSend()">&#9654;</button>
</div>
</div>
<script>
const SERVER = window.location.origin;
const $messages = document.getElementById('messages');
const $input = document.getElementById('msg-input');
const $peerInput = document.getElementById('peer-input');
// ── State ──
let seed = null; // Uint8Array(32)
let myKeyPair = null; // ECDH CryptoKeyPair
let myFingerprint = '';
let derivedKeys = {}; // peerFP -> AES CryptoKey
let pollTimer = null;
// ── Crypto ──
function toHex(buf) {
return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
}
function fromHex(h) {
const clean = h.replace(/[^0-9a-fA-F]/g, '');
const bytes = new Uint8Array(clean.length / 2);
for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(clean.substr(i*2, 2), 16);
return bytes;
}
function formatFP(bytes) {
const h = toHex(bytes);
return h.match(/.{4}/g).join(':');
}
function normFP(fp) {
return fp.replace(/[^0-9a-fA-F]/g, '').toLowerCase();
}
async function generateKeyPair() {
return crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
}
async function computeFingerprint(publicKey) {
const raw = await crypto.subtle.exportKey('raw', publicKey);
const hash = await crypto.subtle.digest('SHA-256', raw);
return new Uint8Array(hash).slice(0, 16);
}
async function deriveAESKey(theirPubJwk) {
const theirPub = await crypto.subtle.importKey('jwk', theirPubJwk, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
const bits = await crypto.subtle.deriveBits({ name: 'ECDH', public: theirPub }, myKeyPair.privateKey, 256);
return crypto.subtle.importKey('raw', bits, 'AES-GCM', false, ['encrypt', 'decrypt']);
}
async function aesEncrypt(key, plaintext) {
const iv = crypto.getRandomValues(new Uint8Array(12));
const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(plaintext));
// iv(12) + ciphertext
const result = new Uint8Array(12 + ct.byteLength);
result.set(iv, 0);
result.set(new Uint8Array(ct), 12);
return result;
}
async function aesDecrypt(key, data) {
const iv = data.slice(0, 12);
const ct = data.slice(12);
const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ct);
return new TextDecoder().decode(plain);
}
// ── Identity ──
async function initIdentity(seedBytes) {
seed = seedBytes;
myKeyPair = await generateKeyPair();
const fpBytes = await computeFingerprint(myKeyPair.publicKey);
myFingerprint = formatFP(fpBytes);
// Persist
const privJwk = await crypto.subtle.exportKey('jwk', myKeyPair.privateKey);
const pubJwk = await crypto.subtle.exportKey('jwk', myKeyPair.publicKey);
localStorage.setItem('wz-seed', toHex(seed));
localStorage.setItem('wz-priv', JSON.stringify(privJwk));
localStorage.setItem('wz-pub', JSON.stringify(pubJwk));
localStorage.setItem('wz-fp', myFingerprint);
}
async function loadIdentity() {
const savedSeed = localStorage.getItem('wz-seed');
const savedPriv = localStorage.getItem('wz-priv');
const savedPub = localStorage.getItem('wz-pub');
const savedFP = localStorage.getItem('wz-fp');
if (!savedSeed || !savedPriv || !savedPub || !savedFP) return false;
seed = fromHex(savedSeed);
const privJwk = JSON.parse(savedPriv);
const pubJwk = JSON.parse(savedPub);
const priv = await crypto.subtle.importKey('jwk', privJwk, { name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
const pub_ = await crypto.subtle.importKey('jwk', pubJwk, { name: 'ECDH', namedCurve: 'P-256' }, true, []);
myKeyPair = { privateKey: priv, publicKey: pub_ };
myFingerprint = savedFP;
return true;
}
// ── Server API ──
async function registerKey() {
const pubJwk = await crypto.subtle.exportKey('jwk', myKeyPair.publicKey);
const fp = normFP(myFingerprint);
const bundleBytes = new TextEncoder().encode(JSON.stringify({ type: 'web', jwk: pubJwk }));
await fetch(SERVER + '/v1/keys/register', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ fingerprint: fp, bundle: Array.from(bundleBytes) })
});
}
async function fetchPeerKey(peerFP) {
const fp = normFP(peerFP);
const cached = derivedKeys[fp];
if (cached) return cached;
const resp = await fetch(SERVER + '/v1/keys/' + fp);
if (!resp.ok) throw new Error('Peer not registered');
const data = await resp.json();
const bundleBytes = Uint8Array.from(atob(data.bundle), c => c.charCodeAt(0));
const bundleStr = new TextDecoder().decode(bundleBytes);
const bundle = JSON.parse(bundleStr);
if (bundle.type !== 'web') throw new Error('Peer is CLI client (incompatible crypto). Use CLI to chat with them.');
const aesKey = await deriveAESKey(bundle.jwk);
derivedKeys[fp] = aesKey;
return aesKey;
}
async function sendEncrypted(peerFP, plaintext) {
const aesKey = await fetchPeerKey(peerFP);
const encrypted = await aesEncrypt(aesKey, plaintext);
const envelope = JSON.stringify({
type: 'web',
from: normFP(myFingerprint),
ciphertext: toHex(encrypted)
});
await fetch(SERVER + '/v1/messages/send', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ to: normFP(peerFP), message: Array.from(new TextEncoder().encode(envelope)) })
});
}
async function pollMessages() {
try {
const fp = normFP(myFingerprint);
const resp = await fetch(SERVER + '/v1/messages/poll/' + fp);
if (!resp.ok) return;
const msgs = await resp.json();
for (const b64 of msgs) {
try {
const bytes = Uint8Array.from(atob(b64), c => c.charCodeAt(0));
const str = new TextDecoder().decode(bytes);
// Try JSON (web client message)
try {
const env = JSON.parse(str);
if (env.type === 'web') {
const aesKey = await fetchPeerKey(env.from);
const ct = fromHex(env.ciphertext);
const text = await aesDecrypt(aesKey, ct);
const fromLabel = formatFP(fromHex(env.from)).slice(0, 19);
const groupTag = env.group ? ' [' + env.group + ']' : '';
addMsg(fromLabel + groupTag, text, false);
continue;
}
} catch(e) { /* not JSON, might be CLI bincode */ }
addSys('[encrypted message from CLI client — use CLI to read]');
} catch(e) {
addSys('[failed to process message]');
}
}
} catch(e) { /* server offline */ }
}
// ── UI ──
function ts() {
return new Date().toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
}
function esc(s) {
const d = document.createElement('div');
d.textContent = s;
return d.innerHTML;
}
function addMsg(from, text, isSelf) {
const d = document.createElement('div');
d.className = 'msg';
const cls = isSelf ? 'from-self' : 'from-peer';
const lock = isSelf ? '' : '<span class="lock">&#128274; </span>';
d.innerHTML = '<span class="ts">' + ts() + '</span> ' + lock + '<span class="' + cls + '">' + esc(from) + '</span>: ' + esc(text);
$messages.appendChild(d);
$messages.scrollTop = $messages.scrollHeight;
}
function addSys(text) {
const d = document.createElement('div');
d.className = 'msg';
d.innerHTML = '<span class="ts">' + ts() + '</span> <span class="from-sys">' + esc(text) + '</span>';
$messages.appendChild(d);
$messages.scrollTop = $messages.scrollHeight;
}
// ── Actions ──
async function doGenerate() {
const s = crypto.getRandomValues(new Uint8Array(32));
await initIdentity(s);
document.getElementById('my-fp').textContent = myFingerprint;
document.getElementById('my-seed').textContent = toHex(seed);
document.getElementById('gen-section').style.display = 'none';
document.getElementById('id-section').style.display = 'block';
}
async function doRecover() {
const input = document.getElementById('recover-input').value.trim();
try {
const s = fromHex(input);
if (s.length !== 32) throw new Error('need 32 bytes');
await initIdentity(s);
document.getElementById('my-fp').textContent = myFingerprint;
document.getElementById('my-seed').textContent = '(recovered)';
document.getElementById('gen-section').style.display = 'none';
document.getElementById('id-section').style.display = 'block';
} catch(e) {
alert('Invalid seed: ' + e.message);
}
}
let currentGroup = null; // if set, messages go to group
async function enterChat() {
document.getElementById('setup').classList.remove('active');
document.getElementById('chat').classList.add('active');
document.getElementById('hdr-fp').textContent = myFingerprint.slice(0, 19);
document.getElementById('hdr-server').textContent = SERVER;
await registerKey();
addSys('Identity loaded: ' + myFingerprint);
addSys('Key registered with server');
addSys('DM: paste peer fingerprint above');
addSys('Groups: /gcreate <name> · /gjoin <name> · /g <name> · /glist');
addSys('Other: /info · /clear · /dm (switch back to DM mode)');
const savedPeer = localStorage.getItem('wz-peer');
if (savedPeer) $peerInput.value = savedPeer;
pollTimer = setInterval(pollMessages, 2000);
$input.focus();
}
// ── Group helpers ──
async function groupCreate(name) {
const resp = await fetch(SERVER + '/v1/groups/create', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ name, creator: normFP(myFingerprint) })
});
const data = await resp.json();
if (data.error) { addSys('Error: ' + data.error); return; }
addSys('Group "' + name + '" created. Join with /gjoin ' + name);
}
async function groupJoin(name) {
const resp = await fetch(SERVER + '/v1/groups/' + name + '/join', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ fingerprint: normFP(myFingerprint) })
});
const data = await resp.json();
if (data.error) { addSys('Error: ' + data.error); return; }
addSys('Joined group "' + name + '" (' + data.members + ' members)');
}
async function groupSwitch(name) {
const resp = await fetch(SERVER + '/v1/groups/' + name);
const data = await resp.json();
if (data.error) { addSys('Error: ' + data.error); return; }
currentGroup = name;
$peerInput.value = '#' + name;
addSys('Switched to group "' + name + '" (' + data.count + ' members: ' + data.members.map(m => m.slice(0,8)).join(', ') + ')');
}
async function groupList() {
const resp = await fetch(SERVER + '/v1/groups');
const data = await resp.json();
if (!data.groups || data.groups.length === 0) { addSys('No groups'); return; }
for (const g of data.groups) {
addSys(' #' + g.name + ' (' + g.members + ' members)');
}
}
async function sendToGroup(groupName, text) {
// Get member list
const resp = await fetch(SERVER + '/v1/groups/' + groupName);
const data = await resp.json();
if (data.error) { addSys('Error: ' + data.error); return; }
const myFP = normFP(myFingerprint);
const members = data.members.filter(m => m !== myFP);
if (members.length === 0) { addSys('No other members in group'); return; }
// Encrypt for each member
const messages = [];
for (const memberFP of members) {
try {
const aesKey = await fetchPeerKey(memberFP);
const encrypted = await aesEncrypt(aesKey, text);
const envelope = JSON.stringify({
type: 'web',
from: myFP,
group: groupName,
ciphertext: toHex(encrypted)
});
messages.push({
to: memberFP,
message: Array.from(new TextEncoder().encode(envelope))
});
} catch(e) {
addSys('Failed to encrypt for ' + memberFP.slice(0,8) + ': ' + e.message);
}
}
if (messages.length === 0) return;
await fetch(SERVER + '/v1/groups/' + groupName + '/send', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ from: myFP, messages })
});
addMsg(myFingerprint.slice(0, 19) + ' [' + groupName + ']', text, true);
}
// ── Send handler ──
async function doSend() {
const text = $input.value.trim();
$input.value = '';
$input.style.height = 'auto';
if (!text) return;
// Commands
if (text === '/info') { addSys('Fingerprint: ' + myFingerprint); return; }
if (text === '/clear') { $messages.innerHTML = ''; return; }
if (text === '/quit') { window.close(); return; }
if (text === '/glist') { await groupList(); return; }
if (text === '/dm') { currentGroup = null; addSys('Switched to DM mode'); $peerInput.value = localStorage.getItem('wz-peer') || ''; return; }
if (text.startsWith('/gcreate ')) { await groupCreate(text.slice(9).trim()); return; }
if (text.startsWith('/gjoin ')) { await groupJoin(text.slice(7).trim()); return; }
if (text.startsWith('/g ')) { await groupSwitch(text.slice(3).trim()); return; }
// Send to group or DM
if (currentGroup) {
try {
await sendToGroup(currentGroup, text);
} catch(e) {
addSys('Group send failed: ' + e.message);
}
return;
}
// DM
const peer = $peerInput.value.trim();
if (!peer || peer.startsWith('#')) { addSys('Set a peer fingerprint or use /g <group>'); return; }
localStorage.setItem('wz-peer', peer);
try {
await sendEncrypted(peer, text);
addMsg(myFingerprint.slice(0, 19), text, true);
} catch(e) {
addSys('Send failed: ' + e.message);
}
}
// Keyboard
$input.onkeydown = function(e) {
if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); doSend(); }
};
$input.addEventListener('input', function() {
this.style.height = 'auto';
this.style.height = Math.min(this.scrollHeight, 120) + 'px';
});
// Auto-load
(async function() {
if (await loadIdentity()) {
enterChat();
}
})();
</script>
</body>
</html>"##;