server.js

'use strict';

/**
 * server.js — the node behind your .anyone address.
 *
 * It runs TWO HTTP listeners so exposure is split by port:
 *
 *   PUBLIC  (127.0.0.1:3000)  ← the hidden service maps here.
 *       GET  /api/identity     your address + public keys + one claimed
 *                               one-time prekey (so peers can X3DH to you)
 *       POST /api/inbox        receive an encrypted envelope from a peer
 *                               (also pushed live over WebSocket, see below)
 *
 *   PRIVATE (127.0.0.1:4000)  ← your UI. NOT mapped to the hidden service.
 *       GET  /                  the chat app
 *       GET  /ws                WebSocket: pushes inbound envelopes to the UI
 *                               in real time (poll remains as a fallback)
 *       GET  /api/whoami        your address + whether identity is set
 *       POST /api/identity      publish your public keys (called once by the browser)
 *       GET  /api/contacts      list contacts (petname ↔ address ↔ keys)
 *       POST /api/contacts      add a contact by address (fetches their keys over Tor/Anyone)
 *       DELETE /api/contacts    remove a contact
 *       POST /api/contacts/opk-used  clear a consumed one-time-prekey from a contact record
 *       GET  /api/messages      pull inbound encrypted envelopes for the browser to decrypt
 *       POST /api/messages/ack  delete envelopes the browser has processed
 *       POST /api/send          deliver an encrypted envelope to a peer's .anyone address
 *       GET  /api/prekeys       how many of YOUR one-time prekeys remain unclaimed
 *       POST /api/prekeys       upload new one-time-prekey PUBLIC keys to top up the pool
 *
 * The browser does ALL encryption/decryption. This process only relays
 * ciphertext and stores ciphertext. It cannot read message contents, and
 * never sees one-time-prekey PRIVATE halves (those live in the browser).
 */

const express = require('express');
const path    = require('path');
const fs      = require('fs');
const crypto  = require('crypto');
const axios   = require('axios');
const { SocksProxyAgent } = require('socks-proxy-agent');
const { WebSocketServer } = require('ws');

const store = require('./lib/store');
const rl    = require('./lib/ratelimit');
const pow   = require('./lib/pow');

// ── Resilience guards ────────────────────────────────────────────────────────
// A messenger backend should stay up to keep the hidden service and WebSocket
// alive. Without these, a single stray promise rejection terminates the process
// (Node 15+) and nothing restarts it. We log loudly and keep running instead.
// (A supervising process with automatic restart would be more robust still — see
// the note in the audit; this is the pragmatic uptime-first floor.)
process.on('unhandledRejection', (reason) => {
  console.error('[server] unhandledRejection:', reason);
});
process.on('uncaughtException', (err) => {
  console.error('[server] uncaughtException:', err && err.stack ? err.stack : err);
});

const PUBLIC_PORT = parseInt(process.env.PUBLIC_PORT || '3000', 10);
const UI_PORT     = parseInt(process.env.UI_PORT     || '4000', 10);
const SOCKS       = process.env.SOCKS || 'socks5h://127.0.0.1:9050'; // h = resolve .anyone via proxy
const HOST        = '127.0.0.1';
const ANON_DIR    = process.env.ANON_DIR || path.join(__dirname, 'anon');
const HOSTNAME_FILE = path.join(ANON_DIR, 'anon_service', 'hostname');
const ANON_LOG    = path.join(ANON_DIR, 'anon.log');
const ANON_COOKIE = path.join(ANON_DIR, 'control_auth_cookie');
const CTRL_PORT   = 9051;

// Send a command to the anon control port (cookie auth).
async function ctrlCmd(cmd) {
  return new Promise((resolve, reject) => {
    let cookie;
    try { cookie = fs.readFileSync(ANON_COOKIE); }
    catch { return reject(new Error('control cookie not yet available — anon may still be bootstrapping')); }
    const sock = require('net').connect(CTRL_PORT, '127.0.0.1', () => {
      sock.write(`AUTHENTICATE ${cookie.toString('hex')}\r\n${cmd}\r\nQUIT\r\n`);
    });
    let out = '';
    sock.on('data', d => { out += d.toString(); });
    sock.on('end',  () => resolve(out));
    sock.on('error', reject);
    setTimeout(() => { sock.destroy(); reject(new Error('control port timeout')); }, 5000);
  });
}
const MAX_ENVELOPE  = 8 * 1024 * 1024;  // 8 MB: covers a 5 MB file + base64 + envelope overhead

// A v3 onion / .anyone address is 56 base32 chars (a-z, 2-7) + ".anyone".
// Validating before we interpolate an address into an outbound URL gives a
// clear error instead of an opaque proxy failure, and rejects anything that
// isn't shaped like a real hidden-service address. Not a hard security
// boundary (the SOCKS proxy only resolves .anyone anyway), but good hygiene.
const ADDR_RE = /^[a-z2-7]{56}\.anyone$/;
function cleanAddr(raw) {
  return String(raw || '').trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/+$/, '');
}
function isValidAddr(addr) {
  return ADDR_RE.test(addr);
}

// N1: validate the SHAPE of an inbound envelope before we store it. The browser
// does all crypto, so a malformed field can't compromise us — but unbounded /
// untyped fields let a sender who passes the gates waste a bounded-inbox row and
// a WebSocket push with structurally-valid junk. We bound sizes and types here.
// Base64 ciphertext/keys are far smaller than these ceilings in practice; the
// limits exist only to reject abuse, not constrain legitimate traffic.
const MAX_DH_LEN  = 512;            // base64 P-256 pubkey is ~88 chars
const MAX_CT_LEN  = 8 * 1024 * 1024;   // matches MAX_ENVELOPE
const MAX_OPK_LEN = 128;
function validEnvelope(env) {
  if (typeof env.from !== 'string' || !env.from) return false;
  if (typeof env.dh   !== 'string' || env.dh.length === 0 || env.dh.length > MAX_DH_LEN) return false;
  if (typeof env.ct   !== 'string' || env.ct.length === 0 || env.ct.length > MAX_CT_LEN) return false;
  if (!Number.isInteger(env.n) || env.n < 0) return false;
  if (env.pn != null && (!Number.isInteger(env.pn) || env.pn < 0)) return false;
  // x3dh, if present, must be a plain object with only the expected string fields.
  if (env.x3dh != null) {
    const x = env.x3dh;
    if (typeof x !== 'object' || Array.isArray(x)) return false;
    if (typeof x.ik !== 'string' || x.ik.length > MAX_DH_LEN) return false;
    if (typeof x.ek !== 'string' || x.ek.length > MAX_DH_LEN) return false;
    if (x.opkId != null && (typeof x.opkId !== 'string' || x.opkId.length > MAX_OPK_LEN)) return false;
  }
  // pow, if present, must carry string challenge + nonce of sane length.
  if (env.pow != null) {
    const p = env.pow;
    if (typeof p !== 'object' || Array.isArray(p)) return false;
    if (typeof p.c !== 'string' || p.c.length > 128) return false;
    if (typeof p.n !== 'string' || p.n.length > 64) return false;
  }
  return true;
}

// ── Helpers ──────────────────────────────────────────────────────────────────
function myAddress() {
  try { return fs.readFileSync(HOSTNAME_FILE, 'utf8').trim(); }
  catch { return null; } // not published yet
}

// A FRESH axios instance + SocksProxyAgent per outbound call, not one shared
// long-lived instance. Empirically, a long-lived agent's connection pool can
// end up in a state where the first POST after earlier successful GETs hangs
// ("Proxy connection timed out") even though a brand-new agent to the same
// peer succeeds instantly. Onion-routing latency (hundreds of ms to seconds)
// dwarfs the cost of a fresh agent+socket per call, so there's no real
// performance reason to pool here — and pooling is the thing that broke.
function onion() {
  const agent = new SocksProxyAgent(SOCKS);
  return axios.create({
    httpAgent: agent,
    httpsAgent: agent,
    proxy: false,          // ignore any HTTP(S)_PROXY env — route ONLY via the SOCKS agent (no leak)
    timeout: 45000,
    maxContentLength: MAX_ENVELOPE,
    maxBodyLength: MAX_ENVELOPE,
  });
}

function noCache(_req, res, next) {
  res.setHeader('Cache-Control', 'no-store');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  // Content-Security-Policy. The UI loads only same-origin assets and talks to
  // its own WebSocket. script-src is strict (no inline/eval) — the theme
  // pre-paint lives in pre-theme.js, not inline. style-src allows inline only
  // because of static style attributes + runtime .style assignments; style
  // injection can't execute code, so this is low risk. Everything else is
  // locked to 'self' or 'none'.
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    "script-src 'self'",
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: blob:",          // avatars are data: URLs, media is blob:
    "media-src 'self' blob:",              // voice messages play from blob: URLs
    "connect-src 'self' ws: wss:",         // WebSocket push to same origin
    "font-src 'self'",
    "object-src 'none'",
    "base-uri 'none'",
    "frame-ancestors 'none'",
    "form-action 'none'",
  ].join('; '));
  res.setHeader('Referrer-Policy', 'no-referrer');
  next();
}

// ── WebSocket push (UI side only — see wss setup near the bottom) ────────────
// Broadcasts inbound envelopes to any connected browser tab the instant
// /api/inbox receives them, so the chat feels real-time. The 4s poll in
// app.js becomes a fallback for missed pushes (e.g. tab opened after the
// message arrived, or a dropped socket).
const wsClients = new Set();
function broadcastEnvelope(envelope) {
  const msg = JSON.stringify({ type: 'inbox', envelope });
  for (const sock of wsClients) {
    if (sock.readyState === 1 /* OPEN */) sock.send(msg);
  }
}

// ── Opportunistic profile refresh ────────────────────────────────────────────
// When a contact sends us something, we already have proof their node is
// reachable AND we're in active conversation with them. That's the right
// moment to cheaply re-fetch their /api/profile and pick up any avatar/name
// changes since add-time. Rate-limited per-contact to avoid hammering a peer
// who sends many messages in a row.
const PROFILE_REFRESH_MS = 60 * 60 * 1000; // opportunistic: at most once per contact per hour
const PROFILE_FORCE_MS   = 10 * 1000;      // forced (profile bump): at most once per contact per 10s
const lastProfileCheck = new Map(); // address -> epoch ms

function maybeRefreshProfile(fromAddr, force = false) {
  const now = Date.now();
  const last = lastProfileCheck.get(fromAddr) || 0;
  // A forced refresh (the contact told us their profile changed) bypasses the
  // hourly opportunistic window, but still has a short floor so a flood of bumps
  // can't make us hammer a peer.
  if (now - last < (force ? PROFILE_FORCE_MS : PROFILE_REFRESH_MS)) return;
  lastProfileCheck.set(fromAddr, now);

  // Fire and forget — refresh runs in the background, never blocks /api/inbox.
  (async () => {
    try {
      const contact = store.getContacts().find(c => c.address === fromAddr);
      if (!contact) return; // not a known contact — nothing to refresh
      const { data } = await onion().get(`http://${fromAddr}/api/profile`);
      if (!data || typeof data !== 'object') return;
      const newAvatar = data.avatar || null;
      const newName   = data.name   || null;
      const newBio    = data.bio    || null;
      // Re-read fresh AFTER the network round-trip: the contact may have been
      // removed or edited during the await. upsertContact() is now atomic, and
      // we re-check existence so we don't resurrect a deleted contact with a
      // stale snapshot.
      const fresh = store.getContacts().find(c => c.address === fromAddr);
      if (!fresh) return; // removed mid-refresh — don't recreate
      if (newAvatar !== (fresh.avatar || null) || newName !== (fresh.name || null) || newBio !== (fresh.bio || null)) {
        store.upsertContact({ address: fromAddr, avatar: newAvatar, name: newName, bio: newBio });
      }
    } catch { /* peer momentarily unreachable, try next time */ }
  })();
}

// ── Presence checks (OPT-IN, off by default) ─────────────────────────────────
// Periodically pings each contact's lightweight /api/profile so the UI can
// show an online/offline dot per contact. Unlike maybeRefreshProfile above,
// this is an ACTIVE probe your node initiates on its own schedule — not
// piggybacked on traffic that's already happening. That's a real metadata
// difference: a network observer (or a malicious contact watching their own
// logs) could notice your node "checking in" on a regular cadence. Off by
// default for that reason; the 👁 toggle in the UI flips this setting.
//
// Staggered (one contact every PRESENCE_STAGGER_MS within a sweep) so N
// contacts doesn't mean N simultaneous circuits, and a short per-request
// timeout so one offline contact doesn't stall the whole sweep.
const presence = new Map(); // address -> { online: bool, lastSeen: number|null }
const PRESENCE_INTERVAL_MS = 3 * 60 * 1000;
const PRESENCE_STAGGER_MS  = 4000;
const PRESENCE_TIMEOUT_MS  = 15000;

async function presenceSweep() {
  for (const c of store.getContacts()) {
    try {
      await onion().get(`http://${c.address}/api/profile`, { timeout: PRESENCE_TIMEOUT_MS });
      presence.set(c.address, { online: true, lastSeen: Date.now() });
    } catch {
      presence.set(c.address, { online: false, lastSeen: presence.get(c.address)?.lastSeen ?? null });
    }
    await new Promise(r => setTimeout(r, PRESENCE_STAGGER_MS));
  }
}
setInterval(presenceSweep, PRESENCE_INTERVAL_MS);
setTimeout(presenceSweep, 15000); // first sweep shortly after boot, not a full interval later

// ── PUBLIC node (reachable through the hidden service) ───────────────────────
const pub = express();
pub.set('trust proxy', 'loopback');
pub.disable('x-powered-by');
pub.use(noCache);
pub.use(express.json({ limit: '10mb' }));   // headroom over the 8 MB envelope cap; rejects oversized bodies early

// CORS: peers connecting from their own nodes may need this for browser-side
// fallbacks. The node-to-node path doesn't, but it's harmless and explicit.
pub.use((_req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
  next();
});

// Lightweight profile lookup: just the human-facing fields, no OPK claim. Used
// for opportunistic avatar refresh on existing contacts when we already have
// fresh traffic from them — cheaper than /api/identity, and doesn't drain the
// one-time-prekey pool on background polls.
pub.get('/api/profile', (_req, res) => {
  const id = store.getIdentity();
  if (!id) return res.status(503).json({ error: 'identity not initialised yet' });
  res.json({ name: id.name || null, avatar: id.avatar || null, bio: id.bio || null });
});

// Profile bump: a contact whose avatar/name/bio changed pings us here so we
// re-fetch their profile immediately instead of waiting for the next hourly
// opportunistic refresh. The bump carries NO profile data — we only act on the
// `from` address, and only if it's already a known contact (so a spoofed bump
// can't make us fetch arbitrary onion services), and the actual data still
// comes from an authenticated PULL to that contact's /api/profile. Worst case a
// forged bump triggers a harmless, rate-limited re-fetch of a contact we
// already trust. Always 200 so we never reveal whether `from` is a contact.
pub.post('/api/profile-bump', (req, res) => {
  const from = cleanAddr(req.body?.from || '');
  if (isValidAddr(from) && store.getContacts().some(c => c.address === from)) {
    maybeRefreshProfile(from, true);
  }
  res.json({ ok: true });
});

// PoW challenge: the current server-side nonce + difficulty. Senders fetch
// this, solve a hashcash puzzle bound to {challenge, from, ct}, and include
// the result in their /api/inbox call when PoW is requested.
pub.get('/api/pow-challenge', (_req, res) => res.json(pow.currentChallenge()));

// Hand out your public keys (+ one one-time prekey, if any remain) so a peer
// can run X3DH to you. Each prekey is claimed (removed from the pool) at
// most once — this is what makes it "one-time".
pub.get('/api/identity', (_req, res) => {
  const id = store.getIdentity();
  if (!id) return res.status(503).json({ error: 'identity not initialised yet' });
  const claimed = store.claimPrekey();
  res.json({
    address: myAddress(),
    ecdhPub: id.ecdhPub,
    ratchetPub: id.ratchetPub,
    ikSigPub: id.ikSigPub || null,
    spkSig: id.spkSig || null,
    name: id.name || null,
    avatar: id.avatar || null,
    bio: id.bio || null,
    opkId: claimed ? claimed.id : null,
    opkPub: claimed ? claimed.pub : null,
  });
});

// Receive an encrypted envelope from a peer. We store ciphertext as-is, and
// immediately push it to any connected UI over WebSocket. Two abuse guards
// before we touch disk:
//   1. Sliding-window rate limit (per source IP + per claimed from-address)
//   2. Optional allow-list mode (only stored contacts can deliver)
pub.post('/api/inbox', (req, res) => {
  const env = req.body || {};
  if (!validEnvelope(env)) return res.status(400).json({ error: 'malformed envelope' });
  // Reject a from-address that isn't a well-formed .anyone address. The ratchet
  // is the real authentication (a forged from can't decrypt), but rejecting junk
  // early keeps the inbox and rate-limit keys clean.
  if (!isValidAddr(cleanAddr(env.from))) return res.status(400).json({ error: 'bad from-address' });

  // Replay check: reject ciphertexts we've seen within the last 24h. This is an
  // in-memory cache (cleared on restart) and only a first-line optimization —
  // the ratchet's own consumed-message set is the authoritative replay defense
  // and rejects replays cryptographically even across restarts.
  if (store.seenEnvelope(env.ct)) {
    return res.status(409).json({ error: 'duplicate envelope' });
  }

  const ip   = (req.headers['x-forwarded-for'] || req.socket.remoteAddress || 'unknown').toString();
  const from = cleanAddr(env.from);

  const reason = rl.classify({ ip, from });
  if (reason) {
    res.set('Retry-After', '60');
    return res.status(429).json({ error: 'rate limited' });
  }

  // Allow-list mode: drop unsolicited senders entirely (no inbox row, no WS
  // push). Still 200 OK so an attacker can't probe membership cheaply — but
  // we count the drop locally so YOU have a breadcrumb (shown as a badge on
  // the 🛡 toggle), since the sender's identical response gives you none.
  const settings = store.getSettings();
  const known = store.getContacts().some(c => c.address === from);
  if (settings.allowlistOnly && !known) {
    store.incrementBlocked();
    return res.json({ ok: true });
  }

  // Proof-of-work: required for strangers under abuse pressure, or always
  // if `powAlways` is on. Contacts always skip — they passed the trust
  // check at add-time. If we ask, the sender must include {pow:{c,n}}
  // bound to this exact envelope; otherwise we 402 with a fresh challenge.
  const powAlways = !!settings.powAlways;
  if (!known && (powAlways || rl.pressure({ ip, from }))) {
    const proof = env.pow;
    const ok = proof && pow.verifyProof({
      challenge: proof.c,
      from,
      ct: env.ct,
      nonce: proof.n,
    });
    if (!ok) {
      const ch = pow.currentChallenge();
      return res.status(402).json({ error: 'proof of work required', challenge: ch.challenge, bits: ch.bits });
    }
  }

  const stored = store.addToInbox({
    id: crypto.randomUUID(),
    from,
    dh: env.dh,
    pn: Number.isInteger(env.pn) ? env.pn : 0,
    n: env.n,
    ct: env.ct,
    // Store only the known x3dh fields, never the raw object — a validated
    // envelope can still carry extra keys we don't want persisted.
    x3dh: env.x3dh ? { ik: env.x3dh.ik, ek: env.x3dh.ek, opkId: env.x3dh.opkId || null } : null,
    receivedAt: Date.now(),
  });
  broadcastEnvelope(stored);
  maybeRefreshProfile(from);
  res.json({ ok: true });
});

// ── PRIVATE UI + local API (loopback only, never on the hidden service) ──────
const ui = express();
ui.disable('x-powered-by');
ui.use(noCache);
ui.use(express.json({ limit: '10mb' }));   // matches the public app; largest UI payload is an 8 MB send envelope
// No-cache headers — forces the Electron renderer to re-fetch JS/CSS on every
// launch instead of serving stale files from Chromium's internal cache.
// Static UI assets. Served with no-cache headers because this is a LOCAL
// desktop app behind an Electron/Chromium renderer whose internal cache
// otherwise serves stale JS/CSS across rebuilds. The asset payload is tiny and
// same-machine, so re-fetching each launch costs nothing here.
//
// L6 / future note: if this UI is ever served REMOTELY (over a network rather
// than loopback), switch to content-hashed filenames (app.<hash>.js) with long
// max-age immutable caching instead of no-cache — re-downloading every asset on
// every load over a real network would be wasteful. Don't simply drop no-cache
// without hashing, or the WebView stale-asset bug returns.
ui.use(express.static(path.join(__dirname, 'public'), {
  etag: false,
  lastModified: false,
  setHeaders: (res) => {
    res.set('Cache-Control', 'no-cache, no-store, must-revalidate');
    res.set('Pragma', 'no-cache');
    res.set('Expires', '0');
  },
}));

ui.get('/api/whoami', (_req, res) => {
  const id = store.getIdentity();
  res.json({ address: myAddress(), hasIdentity: !!id, name: id?.name || null });
});

// Request a new circuit (NEWNYM). Clears the current exit path so subsequent
// connections use different relay nodes. Note: hidden-service circuits are
// managed separately by anon and may not rotate immediately.
ui.post('/api/circuit/new', async (_req, res) => {
  try {
    const out = await ctrlCmd('SIGNAL NEWNYM');
    res.json({ ok: out.includes('250'), raw: out.trim() });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Detailed circuit listing — each circuit's relays enriched with nickname,
// IP, bandwidth, and flags. Powers the Circuits panel in the UI.
const circuits = require('./lib/circuits');
// Stream watcher tracks which circuit is being used for each contact.
// Starts itself when the cookie becomes available (a few seconds after anon).
circuits.startStreamWatcher();

const relaygeo = require('./lib/relaygeo');
// Fetch/refresh the offline geo database over the anon SOCKS proxy, in the
// background. On a FRESH start anon hasn't bootstrapped yet, so the proxy isn't
// ready and the first attempt times out ("Proxy connection timed out"). Rather
// than give up (which left the map empty until the next launch), retry with
// backoff until anon is up and it succeeds. If the DB is already cached and
// fresh, updateDatabase() returns early without downloading. After it lands,
// relaygeo's own daily staleness check keeps it current.
(function ensureGeoDb(attempt) {
  relaygeo.updateDatabase()
    .then(r => { if (r && r.updated) console.log('[relaygeo] libloc DB ready'); })
    .catch(e => {
      if (attempt >= 8) { console.error('[relaygeo] DB update giving up:', e.message); return; }
      const delay = Math.min(20000 * (attempt + 1), 120000);   // 20s, 40s, … cap 2min
      console.log(`[relaygeo] DB not ready yet (${e.message}); retrying in ${Math.round(delay / 1000)}s`);
      setTimeout(() => ensureGeoDb(attempt + 1), delay);
    });
})(0);

ui.get('/api/circuits', async (_req, res) => {
  try {
    const list = await circuits.getCircuitsDetailed();
    res.json({ circuits: list });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Geo-resolved current circuit for the relay-map globe (guard → relay → exit, or
// guard → relay → rendezvous for a hidden-service path).
//   type=socks : a general-traffic circuit   |   type=hs : a hidden-service path
// Read-only: consumes circuits.getCircuitsDetailed() + offline libloc lookups.
// The user's own node is never included (privacy: origin is implicit).
ui.get('/api/circuit/geo', async (req, res) => {
  try {
    const type = req.query.type === 'hs' ? 'hs' : 'socks';
    const list = await circuits.getCircuitsDetailed();
    const isHS = c => /HS_/.test(c.purpose || '') || !!c.hsState;
    let pool;
    if (type === 'hs') {
      // Hidden view = rendezvous (data-path) circuits: HS_CLIENT_REND when we
      // send, HS_SERVICE_REND when we receive. Inbound service-side streams are
      // not reliably reported as in-use, so we PREFER in-use but fall back to the
      // newest rendezvous circuit — otherwise received messages rarely show.
      // Intro circuits (setup, not the message path) are excluded.
      const isRend = c => /REND/i.test(c.purpose || '') ||
        (!!c.hsState && !/INTRO/i.test((c.purpose || '') + ' ' + (c.hsState || '')));
      pool = list.filter(c => isHS(c) && isRend(c));
      pool.sort((a, b) => (b.inUse ? 1 : 0) - (a.inUse ? 1 : 0) || (Number(b.id) || 0) - (Number(a.id) || 0));
    } else {
      // SOCKS = general in-use circuits (matches the Circuits tab).
      pool = list.filter(c => !isHS(c) && c.inUse);
      pool.sort((a, b) => (b.relays ? b.relays.length : 0) - (a.relays ? a.relays.length : 0));
    }
    const pick = pool[0] || null;
    const hops = pick ? relaygeo.hopsFromCircuit(pick) : [];
    res.json({ type, circuitId: pick ? pick.id : null, dbReady: relaygeo.databaseReady(), hops });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Build a fresh circuit (returns its id). Different from NEWNYM, which only
// signals "rotate future paths" — this immediately negotiates a new one.
// Optionally accepts { fps: ['FP1', 'FP2', ...] } for a custom path.
ui.post('/api/circuit/extend', express.json(), async (req, res) => {
  try {
    const fps = req.body && Array.isArray(req.body.fps) ? req.body.fps : null;
    const id  = fps && fps.length ? await circuits.extendCircuitWith(fps) : await circuits.extendCircuit();
    res.json({ ok: !!id, id });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Tear down a specific circuit by ID.
ui.delete('/api/circuit/:id', async (req, res) => {
  try {
    const ok = await circuits.closeCircuit(req.params.id);
    res.json({ ok });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Bandwidth counters — total bytes read/written since anon started.
// Frontend computes deltas between polls to derive a current rate.
ui.get('/api/traffic', async (_req, res) => {
  try { res.json(await circuits.getTraffic()); }
  catch (e) { res.status(503).json({ error: e.message }); }
});

// Filterable router list. Query params:
//   q=substr       — match nickname or fingerprint substring
//   minBw=kb       — minimum bandwidth in KB/s
//   flag=Guard     — must have this flag
//   limit=50       — page size (max 200)
ui.get('/api/routers', async (req, res) => {
  try {
    const all = await circuits.getRouterList();
    const q     = String(req.query.q || '').toLowerCase();
    const minBw = Number(req.query.minBw) || 0;
    const flag  = String(req.query.flag || '');
    const limit = Math.min(200, Number(req.query.limit) || 60);

    let list = all.filter(r => {
      if (minBw && r.bandwidth < minBw) return false;
      if (flag && !r.flags.includes(flag)) return false;
      if (q) {
        const hay = `${(r.nickname || '').toLowerCase()} ${r.fingerprint.toLowerCase()} ${r.ip || ''}`;
        if (!hay.includes(q)) return false;
      }
      return true;
    });

    // Sort by bandwidth desc so the most useful relays surface first.
    list.sort((a, b) => (b.bandwidth || 0) - (a.bandwidth || 0));
    const top = list.slice(0, limit);

    res.json({ total: all.length, count: top.length, routers: top });
  } catch (e) {
    res.status(503).json({ error: e.message });
  }
});

// Richer hidden-service health: descriptor state, intro-point count, and the
// HS circuits we currently hold — so the UI can explain reachability.
ui.get('/api/hs/health', async (_req, res) => {
  try { res.json(await circuits.getServiceHealth(myAddress())); }
  catch (e) { res.status(503).json({ error: e.message }); }
});

// Targeted circuit rebuild: close the circuit currently carrying one contact's
// traffic so a fresh path is built on their next message. Leaves other
// conversations untouched (unlike a global NEWNYM).
ui.post('/api/circuit/rebuild-contact/:addr', async (req, res) => {
  const addr = cleanAddr(req.params.addr);
  if (!isValidAddr(addr)) return res.status(400).json({ error: 'invalid address' });
  try { res.json(await circuits.rebuildCircuitForContact(addr)); }
  catch (e) { res.status(503).json({ error: e.message }); }
});

// Which circuit is currently being used to reach a specific contact?
ui.get('/api/circuit/for-contact/:addr', async (req, res) => {
  const addr = cleanAddr(req.params.addr);
  if (!isValidAddr(addr)) return res.status(400).json({ error: 'invalid address' });
  const info = circuits.getActiveCircuitForAddress(addr);
  res.json(info || { circuitId: null });
});

// Push a lightweight "re-fetch my profile" bump to every contact so a changed
// avatar/name/bio propagates within seconds instead of waiting for the next
// hourly opportunistic refresh on their side. Fire-and-forget per contact;
// failures are ignored (an unreachable contact still picks up the change
// opportunistically on the next message they receive from us).
ui.post('/api/profile/broadcast', (_req, res) => {
  const me = myAddress();
  if (me) {
    for (const c of store.getContacts()) {
      onion().post(`http://${c.address}/api/profile-bump`, { from: me }, { timeout: 15000 }).catch(() => {});
    }
  }
  res.json({ ok: true });
});
// The UI's network-status panel polls this to show live anon output,
// bootstrap progress, and uptime. Returns the last 200 lines of anon.log
// (written by start.js), parsed for the latest bootstrap percentage.
//
// We track the maximum bootstrap value seen — anon.log only retains a tail of
// recent lines, so after a few minutes the "Bootstrapped 100%" line scrolls
// off and a naive re-parse would return 0. The max-seen value keeps the UI
// honest about the current state.
let _maxBootstrap = 0;
ui.get('/api/logs', (_req, res) => {
  let lines = [];
  try {
    const raw = fs.readFileSync(ANON_LOG, 'utf8');
    lines = raw.split('\n').filter(l => l.trim()).slice(-200);
  } catch { /* log not yet written — anon may still be starting */ }

  // Find the most recent bootstrap percentage in the log tail, then clamp to
  // the maximum we've ever seen.
  for (let i = lines.length - 1; i >= 0; i--) {
    const m = lines[i].match(/Bootstrapped (\d+)%/);
    if (m) { const v = parseInt(m[1], 10); if (v > _maxBootstrap) _maxBootstrap = v; break; }
  }

  res.json({
    address:   myAddress() || null,
    uptime:    Math.floor(process.uptime()),
    bootstrap: _maxBootstrap,
    lines,
  });
});

// The browser generates its keypairs and publishes the PUBLIC halves here.
// Merges with the existing record rather than overwriting, so e.g. updating
// just the avatar doesn't drop a previously-set name (and vice versa).
ui.post('/api/identity', (req, res) => {
  const { ecdhPub, ratchetPub, ikSigPub, spkSig, name, avatar, bio } = req.body || {};
  if (!ecdhPub || !ratchetPub) return res.status(400).json({ error: 'missing public keys' });
  const existing = store.getIdentity() || {};
  store.setIdentity({
    ecdhPub,
    ratchetPub,
    // Signed-prekey material. Optional in the request so older callers don't
    // break, but new clients always send it.
    ikSigPub: ikSigPub !== undefined ? (ikSigPub || null) : (existing.ikSigPub ?? null),
    spkSig:   spkSig   !== undefined ? (spkSig   || null) : (existing.spkSig   ?? null),
    name: name !== undefined ? (name || null) : (existing.name ?? null),
    avatar: avatar !== undefined ? (avatar || null) : (existing.avatar ?? null),
    bio: bio !== undefined ? (bio || null) : (existing.bio ?? null),
  });
  res.json({ ok: true, address: myAddress() });
});

// online/lastSeen come from the periodic presenceSweep. null means "unknown"
// (not yet probed), not "offline".
ui.get('/api/contacts', (_req, res) => {
  res.json(store.getContacts().map(c => {
    const p = presence.get(c.address);
    return { ...c, online: p ? p.online : null, lastSeen: p ? p.lastSeen : null };
  }));
});

// Add a contact by address: reach their node over the proxy, fetch their
// public keys (+ a claimed one-time prekey, if they had one available), and
// pin them (trust-on-first-use).
ui.post('/api/contacts', async (req, res) => {
  const { petname, address } = req.body || {};
  if (!petname || !address) return res.status(400).json({ error: 'petname and address required' });
  const addr = cleanAddr(address);
  if (!isValidAddr(addr)) {
    return res.status(400).json({ error: 'invalid .anyone address (expected 56 base32 chars + .anyone)' });
  }

  try {
    const { data } = await onion().get(`http://${addr}/api/identity`);
    if (!data.ecdhPub || !data.ratchetPub) throw new Error('peer returned no keys');
    const contact = store.upsertContact({
      petname: String(petname).slice(0, 40),
      address: addr,
      ecdhPub: data.ecdhPub,
      ratchetPub: data.ratchetPub,
      ikSigPub: data.ikSigPub || null,   // pinned (TOFU) — authenticates their SPK
      spkSig: data.spkSig || null,
      opkId: data.opkId || null,
      opkPub: data.opkPub || null,
      avatar: data.avatar || null,
      bio: data.bio || null,
      addedAt: Date.now(),
    });
    res.json(contact);
  } catch (err) {
    res.status(502).json({ error: `could not reach ${addr}: ${err.message}` });
  }
});

ui.delete('/api/contacts', (req, res) => {
  const { address } = req.body || {};
  if (address) store.removeContact(address);
  res.json({ ok: true });
});

// ── Groups ────────────────────────────────────────────────────────────────────
ui.get('/api/groups',    (_req, res) => res.json(store.getGroups()));

ui.post('/api/groups',   (req, res)  => { store.upsertGroup(req.body); res.json({ ok: true }); });
ui.delete('/api/groups', (req, res)  => { store.removeGroup(req.body?.id); res.json({ ok: true }); });

// The browser calls this once it has consumed a contact's one-time prekey in
// x3dhInitiator, so a later session reset can't accidentally reuse it.
ui.post('/api/contacts/opk-used', (req, res) => {
  const { address } = req.body || {};
  const c = store.getContacts().find(x => x.address === address);
  if (c) store.upsertContact({ ...c, opkId: null, opkPub: null });
  res.json({ ok: true });
});

// Pull inbound envelopes for the browser to decrypt. Optionally prune them.
ui.get('/api/messages', (_req, res) => res.json(store.getInbox()));
ui.post('/api/messages/ack', (req, res) => {
  const ids = Array.isArray(req.body?.ids) ? req.body.ids : [];
  if (ids.length) store.deleteFromInbox(ids);
  res.json({ ok: true });
});

// Deliver an already-encrypted envelope to a peer's .anyone address. If the
// peer's node responds 402 (PoW required), solve the hashcash puzzle bound
// to {challenge, from, ct} and retry once. We do PoW in this process (not
// the browser) so the UI stays responsive — cost is local CPU on send.
const outbox = require('./lib/outbox');

// Force a fresh hidden-service descriptor fetch for a peer. This busts a stale
// descriptor cache that still points at the peer's OLD introduction points
// after they restarted — the root cause of the "back online but unreachable for
// several minutes" problem. HSFETCH triggers an immediate re-fetch from the
// HSDir ring instead of waiting for the cache to expire naturally (~minutes).
// Throttled per-address so repeated retries don't spam the control port.
const _lastHsFetch = new Map();
function refreshPeerDescriptor(addr) {
  const now = Date.now();
  const last = _lastHsFetch.get(addr) || 0;
  if (now - last < 20000) return; // at most once per 20s per peer
  _lastHsFetch.set(addr, now);
  // The control port wants the 56-char onion id without the TLD suffix.
  const onionId = String(addr).replace(/\.anyone$/, '').replace(/\.onion$/, '');
  ctrlCmd(`HSFETCH ${onionId}`).catch(() => {
    // HSFETCH may be unsupported on some anon builds — ignore; the natural
    // cache expiry still recovers eventually, and the queue keeps retrying.
  });
}

// Inject dependencies once the helpers are available (called at bottom of file
// after onion/pow/myAddress are all defined).
function initOutbox() {
  outbox.init({ onion, pow, myAddress, onRetryFail: refreshPeerDescriptor });
  // When the outbox successfully delivers a queued message, push a delivery
  // receipt to any connected UI clients so the message status updates live.
  outbox.on('delivered', (item) => {
    const msg = { type: 'outbox:delivered', id: item.id, toAddress: item.toAddress, queuedAt: item.queuedAt };
    for (const ws of wsClients) try { ws.send(JSON.stringify(msg)); } catch {}
  });
  outbox.on('expired', (item) => {
    const msg = { type: 'outbox:expired', id: item.id, toAddress: item.toAddress };
    for (const ws of wsClients) try { ws.send(JSON.stringify(msg)); } catch {}
  });
}

ui.post('/api/send', async (req, res) => {
  const { toAddress, envelope, msgId, offlineTtl } = req.body || {};
  if (!toAddress || !envelope) return res.status(400).json({ error: 'toAddress and envelope required' });
  const addr = cleanAddr(toAddress);
  if (!isValidAddr(addr)) return res.status(400).json({ error: 'invalid .anyone address' });
  const from = myAddress();
  const payload = { ...envelope, from };
  // Per-message offline expiry chosen by the sender: 1h / 12h / 24h. Anything
  // else (missing/invalid) falls back to the outbox's default ceiling.
  const ALLOWED_TTL = new Set([3600, 43200, 86400]);
  const ttlMs = ALLOWED_TTL.has(Number(offlineTtl)) ? Number(offlineTtl) * 1000 : null;

  // Bounded inline retry. Onion circuits to a peer whose hidden service was
  // recently (re)published frequently fail on the first attempt but succeed on
  // the 2nd/3rd within a few seconds (fresh SOCKS agent + circuit warmup). Try
  // a few times before falling back to the offline queue — otherwise a peer who
  // is actually ONLINE gets treated as offline for a full retry interval, which
  // is exactly the "both online but treated as offline" symptom.
  const TRANSIENT = /HostUnreachable|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up|Proxy connection timed out|proxy.*timed out|timed out|timeout|ESOCKETTIMEDOUT|Network Error|connect ENETUNREACH/i;
  const INLINE_ATTEMPTS = 3;
  let lastErr = null;
  for (let attempt = 1; attempt <= INLINE_ATTEMPTS; attempt++) {
    try {
      await onion().post(`http://${addr}/api/inbox`, payload);
      return res.json({ ok: true, queued: false });
    } catch (err) {
      lastErr = err;
      const status = err.response?.status;
      const data   = err.response?.data;
      // PoW challenge: solve inline and retry once, immediately.
      if (status === 402 && data?.challenge) {
        try {
          const nonce = pow.solve({ challenge: data.challenge, from, ct: envelope.ct, bits: data.bits || 18 });
          const retry = { ...payload, pow: { c: data.challenge, n: nonce } };
          await onion().post(`http://${addr}/api/inbox`, retry);
          return res.json({ ok: true, queued: false, pow: true });
        } catch (err2) {
          const qid = outbox.enqueue(addr, { ...envelope, pow: undefined }, from, ttlMs);
          return res.json({ ok: true, queued: true, queueId: qid, error: err2.message });
        }
      }
      // If it's a transient connection error and we have attempts left, wait
      // briefly and try again on a fresh agent/circuit. Also force a descriptor
      // refresh so a stale cache (peer restarted) gets replaced before the retry.
      if (TRANSIENT.test(err.message) && attempt < INLINE_ATTEMPTS) {
        refreshPeerDescriptor(addr);
        await new Promise(r => setTimeout(r, 2500));
        continue;
      }
      // Out of inline attempts (or a non-transient error): queue if it looks
      // like an offline/connectivity issue, else surface the error.
      if (TRANSIENT.test(err.message)) {
        const qid = outbox.enqueue(addr, envelope, from, ttlMs);
        return res.json({ ok: true, queued: true, queueId: qid });
      }
      return res.status(502).json({ error: `delivery failed: ${err.message}` });
    }
  }
  // Defensive fallback (loop always returns above, but just in case).
  const qid = outbox.enqueue(addr, envelope, from, ttlMs);
  return res.json({ ok: true, queued: true, queueId: qid, error: lastErr?.message });
});

// ── Outbox (queued messages for offline contacts) ───────────────────────────
// The UI polls this to show pending-delivery indicators on messages.
ui.get('/api/outbox', (_req, res) => res.json({ items: outbox.list() }));
ui.delete('/api/outbox/:id', (req, res) => {
  outbox.remove(req.params.id);
  res.json({ ok: true });
});
// Immediate retry trigger — called by the client when it detects the network
// is ready (address just resolved after bootstrap). This covers the case where
// messages were queued during the HS propagation window and the 15s timer
// hasn't fired yet but circuits are now available.
ui.post('/api/outbox/flush', (_req, res) => {
  outbox._flush().catch(() => {});
  res.json({ ok: true });
});

// ── Settings ───────────────────────────────────────────────────────────────
ui.get('/api/settings', (_req, res) => res.json(store.getSettings()));
ui.post('/api/settings', (req, res) => {
  const patch = {};
  if (typeof req.body?.allowlistOnly  === 'boolean') patch.allowlistOnly  = req.body.allowlistOnly;
  if (typeof req.body?.powAlways      === 'boolean') patch.powAlways      = req.body.powAlways;
  if (typeof req.body?.readReceipts   === 'boolean') patch.readReceipts   = req.body.readReceipts;
  if (req.body?.resetBlocked) patch.blockedCount = 0;
  res.json(store.setSettings(patch));
});

// ── One-time prekeys ───────────────────────────────────────────────────────
// The browser owns key generation; this just tracks how many PUBLIC halves
// are sitting in the pool (so the browser knows when to top up) and accepts
// new ones.
ui.get('/api/prekeys', (_req, res) => res.json({ count: store.prekeyCount() }));
ui.post('/api/prekeys', (req, res) => {
  const keys = Array.isArray(req.body?.keys) ? req.body.keys : [];
  if (keys.length) store.addPrekeys(keys);
  res.json({ ok: true, count: store.prekeyCount() });
});

// ── Boot ─────────────────────────────────────────────────────────────────────
pub.listen(PUBLIC_PORT, HOST, () => {
  console.log(`  - public node  -> http://${HOST}:${PUBLIC_PORT}  (mapped to your .anyone address)`);
});

const uiServer = ui.listen(UI_PORT, HOST, () => {
  console.log(`  - private UI   -> http://${HOST}:${UI_PORT}      (open this in your browser)`);
  const addr = myAddress();
  if (addr) console.log(`  - your address -> ${addr}`);
  else      console.log(`  - your address -> (waiting for the anon client to publish the service...)`);
  // Start the outbox retry loop once all helpers are available.
  initOutbox();
});

// WebSocket server attached to the private UI's HTTP server — same loopback
// port (4000), same "never on the hidden service" guarantee. Path /ws.
//
// N3: verify the Origin on the upgrade. The socket is loopback-only, but any
// local process or a browser tab pointed at 127.0.0.1:<ui_port> could otherwise
// connect and receive the inbound ciphertext stream. We accept only connections
// whose Origin is our own UI origin (or no Origin at all — native, non-browser
// clients like Electron's own main-process fetch don't send one). A browser page on a
// different origin always sends its real Origin, so this blocks the cross-origin
// tab case while leaving the legitimate same-origin UI and native clients working.
const UI_ORIGINS = new Set([
  `http://${HOST}:${UI_PORT}`,
  `http://localhost:${UI_PORT}`,
]);
const wss = new WebSocketServer({
  server: uiServer,
  path: '/ws',
  verifyClient: ({ origin }) => {
    if (!origin) return true;            // native client, no Origin header
    return UI_ORIGINS.has(origin);       // browser: must match our own origin
  },
});
wss.on('connection', (sock) => {
  wsClients.add(sock);
  sock.on('close', () => wsClients.delete(sock));
  sock.on('error', () => wsClients.delete(sock));
});