security: kimi-k2.7 review fixes — Ed25519 crypto API, Firestore rules try/catch removal, atomic idempotency, RevenueCat 8.20.0, rate limiter fix, remove plaintext fallback, tighten push wording

app/build.gradle.kts

@@ -97,8 +97,8 @@ dependencies {
     // Encrypted storage
     implementation("androidx.security:security-crypto:1.0.0")
 
-    // RevenueCat
+    // RevenueCat native Android SDK (group: com.revenuecat.purchases, artifact: purchases)
-    implementation("com.revenuecat.purchases:purchases:10.10.0")
+    implementation("com.revenuecat.purchases:purchases:8.20.0")
 
     // Coroutines
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0")

app/src/main/java/app/closer/data/repository/SharedPreferencesLocalAnswerRepository.kt

@@ -23,8 +23,8 @@ class SharedPreferencesLocalAnswerRepository @Inject constructor(
     private val prefs: SharedPreferences = run {
         // Remove legacy plaintext file on first migration
         context.deleteSharedPreferences("local_answers")
-        try {
+
-            // In 1.0.0, EncryptedSharedPreferences.create takes (alias, name, context, ...)
+        // In security-crypto 1.0.0, EncryptedSharedPreferences.create takes (alias, name, context, ...)
         val masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
         EncryptedSharedPreferences.create(
             masterKeyAlias,              // alias (first param)
@@ -33,10 +33,6 @@ class SharedPreferencesLocalAnswerRepository @Inject constructor(
             EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
             EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
         )
-        } catch (_: Exception) {
-            // Fallback to unencrypted SharedPreferences if encryption fails
-            context.getSharedPreferences("local_answers_secure", Context.MODE_PRIVATE)
-        }
     }
     private val answers = MutableStateFlow(readAnswers())
 

firestore.rules

@@ -24,21 +24,14 @@ service cloud.firestore {
     }
 
     function isNotAlreadyPaired() {
-      // Check that the requesting user does not already have a coupleId
+      // Check that the requesting user does not already have a coupleId.
-      // Handle case where user doc might not exist (use getIfExists to avoid throw)
+      // A missing user doc is treated as unpaired.
-      try {
+      let userPath = /databases/$(database)/documents/users/$(request.auth.uid);
-        let userDoc = get(/databases/$(database)/documents/users/$(request.auth.uid));
+      return !exists(userPath) || get(userPath).data.coupleId == null;
-        return !('coupleId' in userDoc.data) || userDoc.data.coupleId == null;
-      } catch (e) {
-        // User doc doesn't exist - treat as unpaired
-        return true;
-      }
     }
 
-    function isServer() {
+    // Admin SDK / Cloud Functions bypass Firestore rules, so any operation that
-      // Check if request comes from admin SDK (no request.auth)
+    // must only be performed server-side is denied for all direct client writes.
-      return request.auth == null;
-    }
 
     function isImmutable(fields) {
       // Helper to check that certain fields haven't changed during an update
@@ -83,16 +76,22 @@ service cloud.firestore {
         // Expired invites should not be readable by non-inviters
         && (request.auth.uid == resource.data.inviterUserId || request.time < resource.data.expiresAt);
 
-      // Create: ownership, code format, and required fields validation
+      // Create: ownership, code format, and required fields validation.
+      // hasOnly prevents injecting unrelated fields (e.g. coupleId) at creation.
       allow create: if isSignedIn()
         && request.resource.data.inviterUserId == request.auth.uid
         && isValidInviteCode(code)
         && isValidInviteCode(request.resource.data.code)
         && request.resource.data.code == code
         && request.resource.data.status == 'pending'
-        && request.resource.data.keys().hasAll(['inviterUserId', 'code', 'status', 'expiresAt']);
+        && request.resource.data.expiresAt is timestamp
+        && request.time < request.resource.data.expiresAt
+        && request.resource.data.keys().hasAll(['inviterUserId', 'code', 'status', 'expiresAt'])
+        && request.resource.data.keys().hasOnly(['inviterUserId', 'code', 'status', 'expiresAt']);
 
-      // Update (accept): proper validation for changing status to accepted
+      // Update (accept): proper validation for changing status to accepted.
+      // If coupleId is supplied, it must reference an existing couple where
+      // the acceptor is a member. (Server-side creation bypasses rules.)
       allow update: if isSignedIn()
         && resource.data.status == 'pending'
         // Cannot accept your own invite
@@ -101,13 +100,23 @@ service cloud.firestore {
         && request.resource.data.acceptorUserId == request.auth.uid
         // Status must change to accepted
         && request.resource.data.status == 'accepted'
-        // Acceptance timestamp must be set
+        // Acceptance timestamp must be set and be a Firestore timestamp
         && request.resource.data.acceptedAt != null
+        && request.resource.data.acceptedAt is timestamp
         // No other fields should be modified in this update
         && request.resource.data.keys().hasOnly(
              ['status', 'acceptorUserId', 'acceptedAt', 'coupleId'])
         // Expired invites cannot be accepted
-        && request.time < resource.data.expiresAt;
+        && request.time < resource.data.expiresAt
+        // coupleId, if provided, must point to a real couple that includes the acceptor
+        && (
+             !('coupleId' in request.resource.data)
+             || (
+                  request.resource.data.coupleId != null
+                  && exists(/databases/$(database)/documents/couples/$(request.resource.data.coupleId))
+                  && request.auth.uid in get(/databases/$(database)/documents/couples/$(request.resource.data.coupleId)).data.userIds
+                )
+           );
     }
 
     // ── Couples ───────────────────────────────────────────────────────────────
@@ -118,8 +127,9 @@ service cloud.firestore {
       // Read: both members can read
       allow read: if isCouplesMember(coupleId);
 
-      // Create: only via invite flow (server-side or admin SDK)
+      // Create: only via invite flow (server-side or admin SDK).
-      allow create: if isServer();
+      // Admin SDK bypasses rules; direct client writes are denied.
+      allow create: if false;
 
       // Update: field-level restrictions
       // - user IDs are immutable (cannot change who is in the couple)
@@ -133,8 +143,8 @@ service cloud.firestore {
         // streakCount and lastStreakAt must not be modified by clients
         && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['streakCount', 'lastStreakAt']);
 
-      // Delete: server-only (admin SDK only)
+      // Delete: server-only (admin SDK only). Admin SDK bypasses rules.
-      allow delete: if isServer();
+      allow delete: if false;
 
       match /sessions/{sessionId} {
         // Read: both members can read
@@ -144,18 +154,20 @@ service cloud.firestore {
         allow create: if isCouplesMember(coupleId)
           && request.resource.data.startedByUserId == request.auth.uid;
 
-        // Update: only the user who started the session can update it, OR valid status transitions
+        // Update: only the user who started the session can update it, OR valid status transitions.
+        // startedByUserId is immutable for direct client writes.
         allow update: if isCouplesMember(coupleId)
           // Either the original starter can update
           && (resource.data.startedByUserId == request.auth.uid
           // Or status transition is valid: active → completed
           || (resource.data.status == 'active' && request.resource.data.status == 'completed'))
-          // Check that other fields haven't been tampered with
+          // startedByUserId cannot be changed by clients
-          && (request.resource.data.startedByUserId == resource.data.startedByUserId
+          && request.resource.data.startedByUserId == resource.data.startedByUserId
-              || isServer());
+          // Only a fixed set of fields may change
+          && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'completedAt']);
 
-        // Delete: server-only (admin SDK)
+        // Delete: server-only (admin SDK). Admin SDK bypasses rules.
-        allow delete: if isServer();
+        allow delete: if false;
       }
 
       // Question threads live under the couple document.
@@ -180,8 +192,8 @@ service cloud.firestore {
           // No other fields should change
           && request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'currentIndex']);
 
-        // Delete: server-only (admin SDK)
+        // Delete: server-only (admin SDK). Admin SDK bypasses rules.
-        allow delete: if isServer();
+        allow delete: if false;
 
         // Answers: each user writes their own; both members can read all answers.
         match /answers/{userId} {

server/.env.example

@@ -6,9 +6,21 @@ FIREBASE_SERVICE_ACCOUNT_PATH=/run/secrets/firebase-service-account.json
 # Your Firebase project ID
 FIREBASE_PROJECT_ID=your-project-id
 
-# RevenueCat webhook shared secret
+# RevenueCat webhook shared secret (legacy; prefer signing key below)
 # Set this in RevenueCat Dashboard > Project > Integrations > Webhooks > Authorization header
 REVENUECAT_WEBHOOK_SECRET=your-revenuecat-webhook-secret
 
+# RevenueCat webhook Ed25519 signing key (modern, preferred)
+# Found in RevenueCat Dashboard > Project > Integrations > Webhooks > Webhook signing
+REVENUECAT_SIGNING_KEY=base64-ed25519-public-key
+
+# Comma-separated product IDs that grant premium access
+REVENUECAT_PREMIUM_PRODUCT_IDS=closer_premium_monthly,closer_premium_yearly
+
+# Rate limits (requests per minute)
+RATE_LIMIT_WEBHOOK=10
+RATE_LIMIT_HEALTH=30
+RATE_LIMIT_DEFAULT=60
+
 # Server port (default 8080)
 PORT=8080

server/src/middleware/rateLimiter.ts

@@ -18,42 +18,41 @@ const DEFAULT_LIMIT = getRateLimit('RATE_LIMIT_DEFAULT', 60)
 
 /**
  * Webhook limiter: 10 requests per minute per IP (configurable via RATE_LIMIT_WEBHOOK)
- * RevenueCat retries are spaced minutes apart, so this is generous
+ * RevenueCat retries are spaced minutes apart, so this is generous.
+ * Successful webhooks (HTTP 200) DO count toward the limit — a processed
+ * webhook should not give an attacker unlimited free requests.
  */
 export const webhookLimiter = rateLimit({
   windowMs: 60 * 1000, // 1 minute
   max: WEBHOOK_LIMIT,
   standardHeaders: true,
   legacyHeaders: false,
-  skipSuccessfulRequests: true,
   keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
   skip: (req) => skipLocalhost(req),
 })
 
 /**
  * Health limiter: 30 requests per minute per IP (configurable via RATE_LIMIT_HEALTH)
- * Allows frequent health checks without abuse
+ * Allows frequent health checks without abuse.
  */
 export const healthLimiter = rateLimit({
   windowMs: 60 * 1000, // 1 minute
   max: HEALTH_LIMIT,
   standardHeaders: true,
   legacyHeaders: false,
-  skipSuccessfulRequests: true,
   keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
   skip: (req) => skipLocalhost(req),
 })
 
 /**
  * Default/API limiter: 60 requests per minute per IP (configurable via RATE_LIMIT_DEFAULT)
- * For future authenticated routes
+ * For future authenticated routes.
  */
 export const defaultLimiter = rateLimit({
   windowMs: 60 * 1000, // 1 minute
   max: DEFAULT_LIMIT,
   standardHeaders: true,
   legacyHeaders: false,
-  skipSuccessfulRequests: true,
   keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
   skip: (req) => skipLocalhost(req),
 })

server/src/routes/webhooks.ts

@@ -1,15 +1,44 @@
 import { Router, Request, Response } from 'express'
 import { syncEntitlement } from '../services/entitlement'
 import { RevenueCatEvent } from '../types'
-import { getEnv } from '../config/env'
+import { getEnvValue } from '../config/env'
 import * as crypto from 'crypto'
 
 const router = Router()
 
+/**
+ * Loads a RevenueCat Ed25519 public key from its base64 form.
+ * RevenueCat typically distributes the raw 32-byte public key (base64).
+ * We also accept DER SPKI form for forward compatibility.
+ */
+function loadRevenueCatPublicKey(base64Key: string): crypto.KeyObject {
+  const keyBytes = Buffer.from(base64Key, 'base64')
+
+  if (keyBytes.length === 32) {
+    // Raw Ed25519 public key -> encode as JWK
+    return crypto.createPublicKey({
+      key: {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: keyBytes.toString('base64url'),
+      },
+      format: 'jwk',
+    })
+  }
+
+  // Otherwise assume DER-encoded SubjectPublicKeyInfo
+  return crypto.createPublicKey({
+    key: keyBytes,
+    format: 'der',
+    type: 'spki',
+  })
+}
+
 /**
  * Verifies RevenueCat webhook signature using Ed25519.
  * RevenueCat signs the raw request body with their signing key.
- * If REVENUECAT_SIGNING_KEY is not set, throws an error (fail-closed).
+ * Returns false for invalid signature/header; throws only for misconfiguration
+ * so the caller can return a 500 (fail-closed).
  */
 function verifyRevenueCatSignature(req: Request): boolean {
   const signingKey = process.env.REVENUECAT_SIGNING_KEY
@@ -34,14 +63,14 @@ function verifyRevenueCatSignature(req: Request): boolean {
   }
 
   try {
-    // RevenueCat sends base64-encoded Ed25519 signature
+    const signature = Buffer.from(
-    const signature = Buffer.from(signatureHeader, 'base64')
+      Array.isArray(signatureHeader) ? signatureHeader[0] : signatureHeader,
-    const publicKey = Buffer.from(signingKey, 'base64')
+      'base64'
+    )
+    const publicKey = loadRevenueCatPublicKey(signingKey)
 
-    // Verify using Ed25519
+    // Ed25519 uses no digest algorithm in Node.js
-    const verify = crypto.createVerify('Ed25519')
+    return crypto.verify(null, rawBody, publicKey, signature)
-    verify.update(rawBody)
-    return verify.verify(publicKey, signature)
   } catch (err) {
     console.error('[webhook] Signature verification failed:', err)
     return false
@@ -50,25 +79,30 @@ function verifyRevenueCatSignature(req: Request): boolean {
 
 /**
  * Verifies RevenueCat webhook secret using constant-time comparison.
- * DEPRECATED: Now uses signature verification. Kept for backwards compatibility.  
+ * Kept as a fallback when signature verification is not configured.
+ * A missing secret causes verification to fail (fail-closed).
  */
 function verifyRevenueCatSecret(req: Request): boolean {
   try {
-    const secret = getEnv('REVENUECAT_WEBHOOK_SECRET')
+    const secret = getEnvValue('REVENUECAT_WEBHOOK_SECRET')
-    const auth = req.headers['authorization'] ?? ''
+    const authHeader = req.headers['authorization']
+    const auth = (Array.isArray(authHeader) ? authHeader[0] : authHeader) ?? ''
+
+    // Missing secret = fail closed
+    if (!secret) {
+      console.error('[webhook] REVENUECAT_WEBHOOK_SECRET not set — rejecting all requests (fail-closed)')
+      return false
+    }
 
     // Constant-time comparison to prevent timing attacks
     const authBuffer = Buffer.from(auth)
     const secretBuffer = Buffer.from(secret)
 
-    // Use timingSafeEqual with fixed buffer length to prevent length leakage
+    if (authBuffer.length !== secretBuffer.length) {
-    const maxLength = Math.max(authBuffer.length, secretBuffer.length)
+      return false
-    const paddedAuth = Buffer.alloc(maxLength)
+    }
-    const paddedSecret = Buffer.alloc(maxLength)
-    authBuffer.copy(paddedAuth)
-    secretBuffer.copy(paddedSecret)
 
-    return crypto.timingSafeEqual(paddedAuth, paddedSecret)
+    return crypto.timingSafeEqual(authBuffer, secretBuffer)
   } catch (err) {
     console.error('[webhook] Secret verification error:', err)
     return false
@@ -76,16 +110,30 @@ function verifyRevenueCatSecret(req: Request): boolean {
 }
 
 router.post('/revenuecat', async (req: Request, res: Response) => {
-  // Try signature verification first (modern, prefered)
+  const signatureKeyConfigured = !!process.env.REVENUECAT_SIGNING_KEY?.trim()
-  try {
+  const secretConfigured = !!process.env.REVENUECAT_WEBHOOK_SECRET?.trim()
-    if (!verifyRevenueCatSignature(req)) {
+
-      res.status(401).json({ error: 'unauthorized' })
+  // Fail closed: at least one auth method must be configured
+  if (!signatureKeyConfigured && !secretConfigured) {
+    console.error('[webhook] No webhook auth configured — rejecting all requests (fail-closed)')
+    res.status(500).json({ error: 'webhook_auth_not_configured' })
     return
   }
+
+  let verified = false
+  try {
+    verified = signatureKeyConfigured
+      ? verifyRevenueCatSignature(req)
+      : verifyRevenueCatSecret(req)
   } catch (err: any) {
-    // If signature verification throws (e.g., missing key), reject with 500
+    // Configuration/internal errors are surfaced as 500 (fail-closed)
-    console.error('[webhook] Signature verification error:', err)
+    console.error('[webhook] Auth verification error:', err)
-    res.status(500).json({ error: 'signature_verification_failed', message: err.message })
+    res.status(500).json({ error: 'auth_verification_failed', message: err.message })
+    return
+  }
+
+  if (!verified) {
+    res.status(401).json({ error: 'unauthorized' })
     return
   }
 

server/src/services/entitlement.ts

@@ -1,6 +1,7 @@
 import { db } from '../config/firebase'
 import { RevenueCatEvent } from '../types'
 import { getEnvValue } from '../config/env'
+import * as admin from 'firebase-admin'
 
 // Product IDs that grant premium access (comma-separated, configurable via env)
 const DEFAULT_PREMIUM_PRODUCT_IDS = 'closer_premium_monthly,closer_premium_yearly'
@@ -43,27 +44,31 @@ export async function verifyPremiumActive(uid: string): Promise<boolean> {
   // hasPremium must be true AND expiration must be in the future
   if (!data.hasPremium) return false
 
-  const expiresAt = data.premiumExpiresAt as FirebaseFirestore.Timestamp | undefined
+  const expiresAt = data.premiumExpiresAt as FirebaseFirestore.Timestamp | Date | undefined
   if (!expiresAt) return false
 
   const now = new Date()
-  const expirationDate = expiresAt.toDate()
+  const expirationDate = typeof (expiresAt as any).toDate === 'function'
+    ? (expiresAt as FirebaseFirestore.Timestamp).toDate()
+    : (expiresAt as Date)
   return expirationDate > now
 }
 
 export async function syncEntitlement(event: RevenueCatEvent): Promise<void> {
   const { type, app_user_id: uid, id: eventId, product_id } = event.event
 
-  // Check idempotency - skip if we've already processed this event
+  // Idempotency: atomically create the event record. If it already exists,
+  // another concurrent request processed it and we abort cleanly.
   const eventRef = db().collection('entitlement_events').doc(eventId)
-  const eventDoc = await eventRef.get()
+  try {
-  if (eventDoc.exists) {
+    await eventRef.create({ processedAt: new Date() })
+  } catch (err: any) {
+    if (err?.code === 6 || err?.message?.includes('ALREADY_EXISTS')) {
       console.log(`[entitlement] skipping duplicate event: ${eventId}`)
       return
     }
-
+    throw err
-  // Store event for idempotency (with 7-day TTL via Firestore rule or scheduled cleanup)
+  }
-  await eventRef.set({ processedAt: new Date() })
 
   // Validate product_id against allowlist
   if (!PRODUCT_ID_ALLOWLIST.has(product_id)) {
@@ -78,27 +83,26 @@ export async function syncEntitlement(event: RevenueCatEvent): Promise<void> {
     return
   }
 
+  const userRef = db().collection('users').doc(uid)
+
   if (PREMIUM_ACTIVE_TYPES.has(type)) {
     const updates: { hasPremium: true; premiumExpiresAt?: FirebaseFirestore.Timestamp } = { hasPremium: true }
 
     // Store expiration timestamp if provided
     const expirationAtMs = event.event.expiration_at_ms
     if (expirationAtMs !== undefined) {
-      updates.premiumExpiresAt = new db().firestore.Timestamp.fromMillis(expirationAtMs)
+      updates.premiumExpiresAt = admin.firestore.Timestamp.fromMillis(expirationAtMs)
     }
 
-    await db().collection('users').doc(uid).update(updates)
+    await userRef.update(updates)
     console.log(`[entitlement] hasPremium=true for ${uid} (${type})`)
     return
   }
 
   if (PREMIUM_REVOKED_TYPES.has(type)) {
-    const updates: { hasPremium: false; premiumExpiresAt?: null } = { hasPremium: false }
+    const updates: { hasPremium: false; premiumExpiresAt: null } = { hasPremium: false, premiumExpiresAt: null }
 
-    // Clear expiration timestamp for revocation events
+    await userRef.update(updates)
-    updates.premiumExpiresAt = null as any
-
-    await db().collection('users').doc(uid).update(updates)
     console.log(`[entitlement] hasPremium=false for ${uid} (${type})`)
     return
   }

server/src/services/fcm.ts

@@ -24,17 +24,17 @@ export async function sendPushToUser(
 
 /**
  * Notify a user that their partner has answered a question.
- * Privacy: Use generic wording that doesn’t reveal question content, categories, or answer previews.
+ * Privacy: Use generic wording that doesn’t reveal question content, categories,
+ * answer previews, or even the partner's name on the lock screen.
  */
 export async function sendPartnerAnsweredNotification(
   partnerFcmToken: string,
-  partnerName: string
+  _partnerName: string
 ): Promise<void> {
-  // Partner name is used only to personalize the greeting; no specific context is included
   await sendPushToUser(
     partnerFcmToken,
     'You have something new from your partner',
-    `${partnerName} answered a question. Tap to see what they said.`,
+    'Tap to open Closer and see what they shared.',
     { type: 'partner_answered' }
   )
 }

settings.gradle.kts

@@ -10,9 +10,6 @@ dependencyResolutionManagement {
     repositories {
         google()
         mavenCentral()
-        maven(url = "https://central.sonatype.com/repository/maven-snapshots/") {
-            content { includeGroup("com.revenuecat.purchases") }
-        }
     }
 }
 rootProject.name = "Closer"