null
/
Closer
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: kimi-k2.7 review fixes — Ed25519 crypto API, Firestore rules try/catch removal, atomic idempotency, RevenueCat 8.20.0, rate limiter fix, remove plaintext fallback, tighten push wording

This commit is contained in:
null 2026-06-16 22:42:53 -05:00
parent b8b2cc68c4
commit a412247bf3
9 changed files with 172 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/build.gradle.kts
View File

@ -97,8 +97,8 @@ dependencies {
// Encrypted storage
implementation("androidx.security:security-crypto:1.0.0")
// RevenueCat
implementation("com.revenuecat.purchases:purchases:10.10.0")
// RevenueCat native Android SDK (group: com.revenuecat.purchases, artifact: purchases)
implementation("com.revenuecat.purchases:purchases:8.20.0")
// Coroutines
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0")

8
app/src/main/java/app/closer/data/repository/SharedPreferencesLocalAnswerRepository.kt
View File

@ -23,8 +23,8 @@ class SharedPreferencesLocalAnswerRepository @Inject constructor(
private val prefs: SharedPreferences = run {
// Remove legacy plaintext file on first migration
context.deleteSharedPreferences("local_answers")
try {
// In 1.0.0, EncryptedSharedPreferences.create takes (alias, name, context, ...)
// In security-crypto 1.0.0, EncryptedSharedPreferences.create takes (alias, name, context, ...)
val masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
EncryptedSharedPreferences.create(
masterKeyAlias, // alias (first param)
@ -33,10 +33,6 @@ class SharedPreferencesLocalAnswerRepository @Inject constructor(
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
} catch (_: Exception) {
// Fallback to unencrypted SharedPreferences if encryption fails
context.getSharedPreferences("local_answers_secure", Context.MODE_PRIVATE)
}
}
private val answers = MutableStateFlow(readAnswers())

72
firestore.rules
View File

@ -24,21 +24,14 @@ service cloud.firestore {
}
function isNotAlreadyPaired() {
// Check that the requesting user does not already have a coupleId
// Handle case where user doc might not exist (use getIfExists to avoid throw)
try {
let userDoc = get(/databases/$(database)/documents/users/$(request.auth.uid));
return !('coupleId' in userDoc.data) || userDoc.data.coupleId == null;
} catch (e) {
// User doc doesn't exist - treat as unpaired
return true;
}
// Check that the requesting user does not already have a coupleId.
// A missing user doc is treated as unpaired.
let userPath = /databases/$(database)/documents/users/$(request.auth.uid);
return !exists(userPath) || get(userPath).data.coupleId == null;
}
function isServer() {
// Check if request comes from admin SDK (no request.auth)
return request.auth == null;
}
// Admin SDK / Cloud Functions bypass Firestore rules, so any operation that
// must only be performed server-side is denied for all direct client writes.
function isImmutable(fields) {
// Helper to check that certain fields haven't changed during an update
@ -83,16 +76,22 @@ service cloud.firestore {
// Expired invites should not be readable by non-inviters
&& (request.auth.uid == resource.data.inviterUserId || request.time < resource.data.expiresAt);
// Create: ownership, code format, and required fields validation
// Create: ownership, code format, and required fields validation.
// hasOnly prevents injecting unrelated fields (e.g. coupleId) at creation.
allow create: if isSignedIn()
&& request.resource.data.inviterUserId == request.auth.uid
&& isValidInviteCode(code)
&& isValidInviteCode(request.resource.data.code)
&& request.resource.data.code == code
&& request.resource.data.status == 'pending'
&& request.resource.data.keys().hasAll(['inviterUserId', 'code', 'status', 'expiresAt']);
&& request.resource.data.expiresAt is timestamp
&& request.time < request.resource.data.expiresAt
&& request.resource.data.keys().hasAll(['inviterUserId', 'code', 'status', 'expiresAt'])
&& request.resource.data.keys().hasOnly(['inviterUserId', 'code', 'status', 'expiresAt']);
// Update (accept): proper validation for changing status to accepted
// Update (accept): proper validation for changing status to accepted.
// If coupleId is supplied, it must reference an existing couple where
// the acceptor is a member. (Server-side creation bypasses rules.)
allow update: if isSignedIn()
&& resource.data.status == 'pending'
// Cannot accept your own invite
@ -101,13 +100,23 @@ service cloud.firestore {
&& request.resource.data.acceptorUserId == request.auth.uid
// Status must change to accepted
&& request.resource.data.status == 'accepted'
// Acceptance timestamp must be set
// Acceptance timestamp must be set and be a Firestore timestamp
&& request.resource.data.acceptedAt != null
&& request.resource.data.acceptedAt is timestamp
// No other fields should be modified in this update
&& request.resource.data.keys().hasOnly(
['status', 'acceptorUserId', 'acceptedAt', 'coupleId'])
// Expired invites cannot be accepted
&& request.time < resource.data.expiresAt;
&& request.time < resource.data.expiresAt
// coupleId, if provided, must point to a real couple that includes the acceptor
&& (
!('coupleId' in request.resource.data)
|| (
request.resource.data.coupleId != null
&& exists(/databases/$(database)/documents/couples/$(request.resource.data.coupleId))
&& request.auth.uid in get(/databases/$(database)/documents/couples/$(request.resource.data.coupleId)).data.userIds
)
);
}
// ── Couples ───────────────────────────────────────────────────────────────
@ -118,8 +127,9 @@ service cloud.firestore {
// Read: both members can read
allow read: if isCouplesMember(coupleId);
// Create: only via invite flow (server-side or admin SDK)
allow create: if isServer();
// Create: only via invite flow (server-side or admin SDK).
// Admin SDK bypasses rules; direct client writes are denied.
allow create: if false;
// Update: field-level restrictions
// - user IDs are immutable (cannot change who is in the couple)
@ -133,8 +143,8 @@ service cloud.firestore {
// streakCount and lastStreakAt must not be modified by clients
&& !request.resource.data.diff(resource.data).affectedKeys().hasAny(['streakCount', 'lastStreakAt']);
// Delete: server-only (admin SDK only)
allow delete: if isServer();
// Delete: server-only (admin SDK only). Admin SDK bypasses rules.
allow delete: if false;
match /sessions/{sessionId} {
// Read: both members can read
@ -144,18 +154,20 @@ service cloud.firestore {
allow create: if isCouplesMember(coupleId)
&& request.resource.data.startedByUserId == request.auth.uid;
// Update: only the user who started the session can update it, OR valid status transitions
// Update: only the user who started the session can update it, OR valid status transitions.
// startedByUserId is immutable for direct client writes.
allow update: if isCouplesMember(coupleId)
// Either the original starter can update
&& (resource.data.startedByUserId == request.auth.uid
// Or status transition is valid: active → completed
|| (resource.data.status == 'active' && request.resource.data.status == 'completed'))
// Check that other fields haven't been tampered with
&& (request.resource.data.startedByUserId == resource.data.startedByUserId
|| isServer());
// startedByUserId cannot be changed by clients
&& request.resource.data.startedByUserId == resource.data.startedByUserId
// Only a fixed set of fields may change
&& request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'completedAt']);
// Delete: server-only (admin SDK)
allow delete: if isServer();
// Delete: server-only (admin SDK). Admin SDK bypasses rules.
allow delete: if false;
}
// Question threads live under the couple document.
@ -180,8 +192,8 @@ service cloud.firestore {
// No other fields should change
&& request.resource.data.diff(resource.data).affectedKeys().hasOnly(['status', 'currentIndex']);
// Delete: server-only (admin SDK)
allow delete: if isServer();
// Delete: server-only (admin SDK). Admin SDK bypasses rules.
allow delete: if false;
// Answers: each user writes their own; both members can read all answers.
match /answers/{userId} {

14
server/.env.example
View File

@ -6,9 +6,21 @@ FIREBASE_SERVICE_ACCOUNT_PATH=/run/secrets/firebase-service-account.json
# Your Firebase project ID
FIREBASE_PROJECT_ID=your-project-id
# RevenueCat webhook shared secret
# RevenueCat webhook shared secret (legacy; prefer signing key below)
# Set this in RevenueCat Dashboard > Project > Integrations > Webhooks > Authorization header
REVENUECAT_WEBHOOK_SECRET=your-revenuecat-webhook-secret
# RevenueCat webhook Ed25519 signing key (modern, preferred)
# Found in RevenueCat Dashboard > Project > Integrations > Webhooks > Webhook signing
REVENUECAT_SIGNING_KEY=base64-ed25519-public-key
# Comma-separated product IDs that grant premium access
REVENUECAT_PREMIUM_PRODUCT_IDS=closer_premium_monthly,closer_premium_yearly
# Rate limits (requests per minute)
RATE_LIMIT_WEBHOOK=10
RATE_LIMIT_HEALTH=30
RATE_LIMIT_DEFAULT=60
# Server port (default 8080)
PORT=8080

11
server/src/middleware/rateLimiter.ts
View File

@ -18,42 +18,41 @@ const DEFAULT_LIMIT = getRateLimit('RATE_LIMIT_DEFAULT', 60)
/**
* Webhook limiter: 10 requests per minute per IP (configurable via RATE_LIMIT_WEBHOOK)
* RevenueCat retries are spaced minutes apart, so this is generous
* RevenueCat retries are spaced minutes apart, so this is generous.
* Successful webhooks (HTTP 200) DO count toward the limit — a processed
* webhook should not give an attacker unlimited free requests.
*/
export const webhookLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: WEBHOOK_LIMIT,
standardHeaders: true,
legacyHeaders: false,
skipSuccessfulRequests: true,
keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
skip: (req) => skipLocalhost(req),
})
/**
* Health limiter: 30 requests per minute per IP (configurable via RATE_LIMIT_HEALTH)
* Allows frequent health checks without abuse
* Allows frequent health checks without abuse.
*/
export const healthLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: HEALTH_LIMIT,
standardHeaders: true,
legacyHeaders: false,
skipSuccessfulRequests: true,
keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
skip: (req) => skipLocalhost(req),
})
/**
* Default/API limiter: 60 requests per minute per IP (configurable via RATE_LIMIT_DEFAULT)
* For future authenticated routes
* For future authenticated routes.
*/
export const defaultLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: DEFAULT_LIMIT,
standardHeaders: true,
legacyHeaders: false,
skipSuccessfulRequests: true,
keyGenerator: (req) => req.ip || req.socket?.remoteAddress || 'unknown',
skip: (req) => skipLocalhost(req),
})

100
server/src/routes/webhooks.ts
View File

@ -1,15 +1,44 @@
import { Router, Request, Response } from 'express'
import { syncEntitlement } from '../services/entitlement'
import { RevenueCatEvent } from '../types'
import { getEnv } from '../config/env'
import { getEnvValue } from '../config/env'
import * as crypto from 'crypto'
const router = Router()
/**
* Loads a RevenueCat Ed25519 public key from its base64 form.
* RevenueCat typically distributes the raw 32-byte public key (base64).
* We also accept DER SPKI form for forward compatibility.
*/
function loadRevenueCatPublicKey(base64Key: string): crypto.KeyObject {
const keyBytes = Buffer.from(base64Key, 'base64')
if (keyBytes.length === 32) {
// Raw Ed25519 public key -> encode as JWK
return crypto.createPublicKey({
key: {
kty: 'OKP',
crv: 'Ed25519',
x: keyBytes.toString('base64url'),
},
format: 'jwk',
})
}
// Otherwise assume DER-encoded SubjectPublicKeyInfo
return crypto.createPublicKey({
key: keyBytes,
format: 'der',
type: 'spki',
})
}
/**
* Verifies RevenueCat webhook signature using Ed25519.
* RevenueCat signs the raw request body with their signing key.
* If REVENUECAT_SIGNING_KEY is not set, throws an error (fail-closed).
* Returns false for invalid signature/header; throws only for misconfiguration
* so the caller can return a 500 (fail-closed).
*/
function verifyRevenueCatSignature(req: Request): boolean {
const signingKey = process.env.REVENUECAT_SIGNING_KEY
@ -34,14 +63,14 @@ function verifyRevenueCatSignature(req: Request): boolean {
}
try {
// RevenueCat sends base64-encoded Ed25519 signature
const signature = Buffer.from(signatureHeader, 'base64')
const publicKey = Buffer.from(signingKey, 'base64')
const signature = Buffer.from(
Array.isArray(signatureHeader) ? signatureHeader[0] : signatureHeader,
'base64'
)
const publicKey = loadRevenueCatPublicKey(signingKey)
// Verify using Ed25519
const verify = crypto.createVerify('Ed25519')
verify.update(rawBody)
return verify.verify(publicKey, signature)
// Ed25519 uses no digest algorithm in Node.js
return crypto.verify(null, rawBody, publicKey, signature)
} catch (err) {
console.error('[webhook] Signature verification failed:', err)
return false
@ -50,25 +79,30 @@ function verifyRevenueCatSignature(req: Request): boolean {
/**
* Verifies RevenueCat webhook secret using constant-time comparison.
* DEPRECATED: Now uses signature verification. Kept for backwards compatibility.
* Kept as a fallback when signature verification is not configured.
* A missing secret causes verification to fail (fail-closed).
*/
function verifyRevenueCatSecret(req: Request): boolean {
try {
const secret = getEnv('REVENUECAT_WEBHOOK_SECRET')
const auth = req.headers['authorization'] ?? ''
const secret = getEnvValue('REVENUECAT_WEBHOOK_SECRET')
const authHeader = req.headers['authorization']
const auth = (Array.isArray(authHeader) ? authHeader[0] : authHeader) ?? ''
// Missing secret = fail closed
if (!secret) {
console.error('[webhook] REVENUECAT_WEBHOOK_SECRET not set — rejecting all requests (fail-closed)')
return false
}
// Constant-time comparison to prevent timing attacks
const authBuffer = Buffer.from(auth)
const secretBuffer = Buffer.from(secret)
// Use timingSafeEqual with fixed buffer length to prevent length leakage
const maxLength = Math.max(authBuffer.length, secretBuffer.length)
const paddedAuth = Buffer.alloc(maxLength)
const paddedSecret = Buffer.alloc(maxLength)
authBuffer.copy(paddedAuth)
secretBuffer.copy(paddedSecret)
if (authBuffer.length !== secretBuffer.length) {
return false
}
return crypto.timingSafeEqual(paddedAuth, paddedSecret)
return crypto.timingSafeEqual(authBuffer, secretBuffer)
} catch (err) {
console.error('[webhook] Secret verification error:', err)
return false
@ -76,16 +110,30 @@ function verifyRevenueCatSecret(req: Request): boolean {
}
router.post('/revenuecat', async (req: Request, res: Response) => {
// Try signature verification first (modern, prefered)
try {
if (!verifyRevenueCatSignature(req)) {
res.status(401).json({ error: 'unauthorized' })
const signatureKeyConfigured = !!process.env.REVENUECAT_SIGNING_KEY?.trim()
const secretConfigured = !!process.env.REVENUECAT_WEBHOOK_SECRET?.trim()
// Fail closed: at least one auth method must be configured
if (!signatureKeyConfigured && !secretConfigured) {
console.error('[webhook] No webhook auth configured — rejecting all requests (fail-closed)')
res.status(500).json({ error: 'webhook_auth_not_configured' })
return
}
let verified = false
try {
verified = signatureKeyConfigured
? verifyRevenueCatSignature(req)
: verifyRevenueCatSecret(req)
} catch (err: any) {
// If signature verification throws (e.g., missing key), reject with 500
console.error('[webhook] Signature verification error:', err)
res.status(500).json({ error: 'signature_verification_failed', message: err.message })
// Configuration/internal errors are surfaced as 500 (fail-closed)
console.error('[webhook] Auth verification error:', err)
res.status(500).json({ error: 'auth_verification_failed', message: err.message })
return
}
if (!verified) {
res.status(401).json({ error: 'unauthorized' })
return
}

34
server/src/services/entitlement.ts
View File

@ -1,6 +1,7 @@
import { db } from '../config/firebase'
import { RevenueCatEvent } from '../types'
import { getEnvValue } from '../config/env'
import * as admin from 'firebase-admin'
// Product IDs that grant premium access (comma-separated, configurable via env)
const DEFAULT_PREMIUM_PRODUCT_IDS = 'closer_premium_monthly,closer_premium_yearly'
@ -43,27 +44,31 @@ export async function verifyPremiumActive(uid: string): Promise<boolean> {
// hasPremium must be true AND expiration must be in the future
if (!data.hasPremium) return false
const expiresAt = data.premiumExpiresAt as FirebaseFirestore.Timestamp | undefined
const expiresAt = data.premiumExpiresAt as FirebaseFirestore.Timestamp | Date | undefined
if (!expiresAt) return false
const now = new Date()
const expirationDate = expiresAt.toDate()
const expirationDate = typeof (expiresAt as any).toDate === 'function'
? (expiresAt as FirebaseFirestore.Timestamp).toDate()
: (expiresAt as Date)
return expirationDate > now
}
export async function syncEntitlement(event: RevenueCatEvent): Promise<void> {
const { type, app_user_id: uid, id: eventId, product_id } = event.event
// Check idempotency - skip if we've already processed this event
// Idempotency: atomically create the event record. If it already exists,
// another concurrent request processed it and we abort cleanly.
const eventRef = db().collection('entitlement_events').doc(eventId)
const eventDoc = await eventRef.get()
if (eventDoc.exists) {
try {
await eventRef.create({ processedAt: new Date() })
} catch (err: any) {
if (err?.code === 6 || err?.message?.includes('ALREADY_EXISTS')) {
console.log(`[entitlement] skipping duplicate event: ${eventId}`)
return
}
// Store event for idempotency (with 7-day TTL via Firestore rule or scheduled cleanup)
await eventRef.set({ processedAt: new Date() })
throw err
}
// Validate product_id against allowlist
if (!PRODUCT_ID_ALLOWLIST.has(product_id)) {
@ -78,27 +83,26 @@ export async function syncEntitlement(event: RevenueCatEvent): Promise<void> {
return
}
const userRef = db().collection('users').doc(uid)
if (PREMIUM_ACTIVE_TYPES.has(type)) {
const updates: { hasPremium: true; premiumExpiresAt?: FirebaseFirestore.Timestamp } = { hasPremium: true }
// Store expiration timestamp if provided
const expirationAtMs = event.event.expiration_at_ms
if (expirationAtMs !== undefined) {
updates.premiumExpiresAt = new db().firestore.Timestamp.fromMillis(expirationAtMs)
updates.premiumExpiresAt = admin.firestore.Timestamp.fromMillis(expirationAtMs)
}
await db().collection('users').doc(uid).update(updates)
await userRef.update(updates)
console.log(`[entitlement] hasPremium=true for ${uid} (${type})`)
return
}
if (PREMIUM_REVOKED_TYPES.has(type)) {
const updates: { hasPremium: false; premiumExpiresAt?: null } = { hasPremium: false }
const updates: { hasPremium: false; premiumExpiresAt: null } = { hasPremium: false, premiumExpiresAt: null }
// Clear expiration timestamp for revocation events
updates.premiumExpiresAt = null as any
await db().collection('users').doc(uid).update(updates)
await userRef.update(updates)
console.log(`[entitlement] hasPremium=false for ${uid} (${type})`)
return
}

8
server/src/services/fcm.ts
View File

@ -24,17 +24,17 @@ export async function sendPushToUser(
/**
* Notify a user that their partner has answered a question.
* Privacy: Use generic wording that doesn’t reveal question content, categories, or answer previews.
* Privacy: Use generic wording that doesn’t reveal question content, categories,
* answer previews, or even the partner's name on the lock screen.
*/
export async function sendPartnerAnsweredNotification(
partnerFcmToken: string,
partnerName: string
_partnerName: string
): Promise<void> {
// Partner name is used only to personalize the greeting; no specific context is included
await sendPushToUser(
partnerFcmToken,
'You have something new from your partner',
`${partnerName} answered a question. Tap to see what they said.`,
'Tap to open Closer and see what they shared.',
{ type: 'partner_answered' }
)
}

3
settings.gradle.kts
View File

@ -10,9 +10,6 @@ dependencyResolutionManagement {
repositories {
google()
mavenCentral()
maven(url = "https://central.sonatype.com/repository/maven-snapshots/") {
content { includeGroup("com.revenuecat.purchases") }
}
}
}
rootProject.name = "Closer"