improve security; encrypt tokens at rest

.gitignore

···
 dist/
 private-key.pem
 public-jwk.json
-keygen.js
 test-data/

netlify.toml

···
     Cache-Control = "public, max-age=3600"
 
 [[headers]]
-  for = "/.well-known/*"
-  [headers.values]
+    for = "/.well-known/*"
+    [headers.values]
     Access-Control-Allow-Origin = "*"
 
-    [[headers]]
-      for = "/*"
-      [headers.values]
-        Content-Security-Policy = """
-          default-src 'self';
-          script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com;
-          style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
-          font-src 'self' https://fonts.gstatic.com;
-          img-src 'self' data: https:;
-          connect-src 'self' https://bsky.social https://*.bsky.network;
-          frame-ancestors 'none';
-          base-uri 'self';
-          form-action 'self';
-        """
-        X-Frame-Options = "DENY"
-        X-Content-Type-Options = "nosniff"
-        Referrer-Policy = "strict-origin-when-cross-origin"
+[[headers]]
+    for = "/*"
+    [headers.values]
+    X-Frame-Options = "DENY"
+    X-Content-Type-Options = "nosniff"
+    X-XSS-Protection = "1; mode=block"
+    Referrer-Policy = "strict-origin-when-cross-origin"
+    Permissions-Policy = "geolocation=(), microphone=(), camera=()"
+    Content-Security-Policy = "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://*.bsky.app https://*.bsky.network https://public.api.bsky.app; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests;"

netlify/functions/core/config/constants.ts

···
   STATE_EXPIRY: 10 * 60 * 1000, // 10 minutes
   COOKIE_MAX_AGE: 2592000, // 30 days in seconds,
   OAUTH_KEY_ID: "main-key", // jwks kid
-  OAUTH_SCOPES: "atproto transition:generic", // future?: atproto repo:app.bsky.graph.follow?action=create repo:so.sprk.graph.follow?action=create repo:sh.tangled.graph.follow?action=create
+  OAUTH_SCOPES: "atproto transition:generic", // future?: atproto rpc:app.bsky.graph.getFollows?aud=* rpc:app.bsky.actor.getProfile?aud=* repo:app.bsky.graph.follow?action=create repo:so.sprk.graph.follow?action=create repo:sh.tangled.graph.follow?action=create
 } as const;

netlify/functions/core/middleware/session-security.middleware.ts

···
+import { HandlerEvent } from "@netlify/functions";
+
+interface SessionFingerprint {
+  userAgent: string;
+  ipAddress: string;
+  createdAt: number;
+}
+
+/**
+ * Session Security Service
+ * Provides additional session replay protection and fingerprinting
+ */
+export class SessionSecurityService {
+  /**
+   * Generate a session fingerprint from request headers
+   */
+  static generateFingerprint(event: HandlerEvent): SessionFingerprint {
+    const userAgent = event.headers["user-agent"] || "unknown";
+    const ipAddress =
+      event.headers["x-forwarded-for"]?.split(",")[0].trim() ||
+      event.headers["client-ip"] ||
+      "unknown";
+
+    return {
+      userAgent,
+      ipAddress,
+      createdAt: Date.now(),
+    };
+  }
+
+  /**
+   * Verify session fingerprint matches current request
+   * Helps detect session hijacking
+   */
+  static verifyFingerprint(
+    stored: SessionFingerprint,
+    current: SessionFingerprint,
+  ): boolean {
+    // User agent must match exactly
+    if (stored.userAgent !== current.userAgent) {
+      console.warn("Session fingerprint mismatch: User-Agent changed");
+      return false;
+    }
+
+    // IP can change (mobile networks, VPN) but log if it does
+    if (stored.ipAddress !== current.ipAddress) {
+      console.info(
+        `Session IP changed: ${stored.ipAddress} -> ${current.ipAddress}`,
+      );
+      // Don't fail - just log for monitoring
+    }
+
+    return true;
+  }
+
+  /**
+   * Check if session is being used suspiciously fast
+   * (potential replay attack)
+   */
+  static detectSuspiciousActivity(
+    lastUsed: number,
+    minIntervalMs: number = 100,
+  ): boolean {
+    const timeSinceLastUse = Date.now() - lastUsed;
+
+    // If requests are less than 100ms apart, suspicious
+    if (timeSinceLastUse < minIntervalMs) {
+      console.warn(
+        `Suspicious activity: Request ${timeSinceLastUse}ms after last use`,
+      );
+      return true;
+    }
+
+    return false;
+  }
+}
+
+/**
+ * Enhanced session validation middleware
+ * Adds fingerprinting to detect session hijacking
+ */
+export async function validateSessionSecurity(
+  event: HandlerEvent,
+  sessionId: string,
+): Promise<void> {
+  const currentFingerprint = SessionSecurityService.generateFingerprint(event);
+
+  // Get stored fingerprint (would need to extend UserSessionStore)
+  // For now, just log current fingerprint for monitoring
+  console.log("Session fingerprint:", {
+    sessionId: sessionId.substring(0, 8) + "...",
+    userAgent: currentFingerprint.userAgent.substring(0, 50),
+    ip: currentFingerprint.ipAddress,
+  });
+
+  // Future: Store and compare fingerprints
+  // const session = await userSessions.get(sessionId);
+  // if (session.fingerprint) {
+  //   if (!SessionSecurityService.verifyFingerprint(session.fingerprint, currentFingerprint)) {
+  //     throw new AuthenticationError("Session security check failed");
+  //   }
+  // }
+}
+
+/**
+ * Add session fingerprint to new sessions
+ * Call this in oauth-callback.ts when creating session
+ */
+export function createSecureSessionData(
+  event: HandlerEvent,
+  did: string,
+): { did: string; fingerprint: SessionFingerprint } {
+  return {
+    did,
+    fingerprint: SessionSecurityService.generateFingerprint(event),
+  };
+}

netlify/functions/core/types/api.types.ts

···
 }
 
 export interface SessionData {
+  dpopJwk?: any;
   dpopKey: any;
   tokenSet: any;
+  authMethod?: string;
 }
 
 export interface UserSessionData {
   did: string;
+  fingerprint?: any;
 }
 
 // OAuth configuration

netlify/functions/core/types/database.types.ts

···
 export interface OAuthSessionRow {
   key: string;
   data: {
-    dpopKey: any;
+    dpopJwk?: any;
+    dpopKey?: any;
     tokenSet: any;
+    authMethod?: string;
+    encrypted?: boolean;
   };
   created_at: Date;
   expires_at: Date;
···
 export interface UserSessionRow {
   session_id: string;
   did: string;
+  fingerprint?: any;
   created_at: Date;
   expires_at: Date;
 }

netlify/functions/infrastructure/database/DatabaseService.ts

···
       CREATE TABLE IF NOT EXISTS user_sessions (
         session_id TEXT PRIMARY KEY,
         did TEXT NOT NULL,
+        fingerprint JSONB,
         created_at TIMESTAMP DEFAULT NOW(),
         expires_at TIMESTAMP NOT NULL
       )

netlify/functions/infrastructure/oauth/stores/SessionStore.ts

···
 import { getDbClient } from "../../database";
 import { SessionData, OAuthSessionRow } from "../../../core/types";
 import { CONFIG } from "../../../core/config/constants";
+import {
+  encryptToken,
+  decryptToken,
+  isEncryptionConfigured,
+} from "../../../utils/encryption.utils";
 
 export class PostgresSessionStore {
   private sql = getDbClient();
+  private encryptionEnabled = isEncryptionConfigured();
 
   async get(key: string): Promise<SessionData | undefined> {
     const result = await this.sql`
···
       WHERE key = ${key} AND expires_at > NOW()
     `;
     const rows = result as OAuthSessionRow[];
-    return rows[0]?.data as SessionData | undefined;
+
+    if (!rows[0]) return undefined;
+
+    const stored = rows[0].data;
+
+    // Handle encrypted format
+    if (
+      this.encryptionEnabled &&
+      typeof stored === "object" &&
+      stored.encrypted
+    ) {
+      try {
+        // Decrypt tokenSet and reconstruct with dpopJwk
+        const decryptedTokenSet = decryptToken(stored.tokenSet);
+
+        return {
+          dpopJwk: stored.dpopJwk, // Use dpopJwk (not dpopKey!)
+          tokenSet: decryptedTokenSet,
+          authMethod: stored.authMethod,
+        } as SessionData;
+      } catch (error) {
+        console.error(
+          "[SessionStore] Failed to decrypt session token set:",
+          error,
+        );
+        return undefined;
+      }
+    }
+
+    // Fallback for unencrypted format
+    return stored as SessionData;
   }
 
   async set(key: string, value: SessionData): Promise<void> {
     const expiresAt = new Date(Date.now() + CONFIG.SESSION_EXPIRY);
+
+    let dataToStore: any;
+
+    if (this.encryptionEnabled) {
+      // Encrypt only tokenSet, keep dpopJwk and authMethod as-is
+      dataToStore = {
+        encrypted: true,
+        dpopJwk: (value as any).dpopJwk,
+        authMethod: (value as any).authMethod,
+        tokenSet: encryptToken(value.tokenSet),
+      };
+    } else {
+      // Store as-is if encryption disabled
+      dataToStore = value;
+    }
+
     await this.sql`
       INSERT INTO oauth_sessions (key, data, expires_at)
-      VALUES (${key}, ${JSON.stringify(value)}, ${expiresAt})
+      VALUES (${key}, ${JSON.stringify(dataToStore)}, ${expiresAt})
       ON CONFLICT (key) DO UPDATE SET
-        data = ${JSON.stringify(value)},
+        data = ${JSON.stringify(dataToStore)},
         expires_at = ${expiresAt}
     `;
   }

netlify/functions/infrastructure/oauth/stores/StateStore.ts

···
       WHERE key = ${key} AND expires_at > NOW()
     `;
     const rows = result as OAuthStateRow[];
-    return rows[0]?.data as StateData | undefined;
+
+    if (!rows[0]) return undefined;
+
+    // State data contains dpopKey which must remain as JWK object
+    // We don't encrypt state data - it's ephemeral (10 min expiry)
+    return rows[0].data as StateData;
   }
 
   async set(key: string, value: StateData): Promise<void> {
     const expiresAt = new Date(Date.now() + CONFIG.STATE_EXPIRY);
+
+    // Store as-is - no encryption for state data
+    // State is ephemeral and dpopKey needs to be valid JWK
+    const dataToStore = JSON.stringify(value);
+
     await this.sql`
       INSERT INTO oauth_states (key, data, expires_at)
-      VALUES (${key}, ${JSON.stringify(value)}, ${expiresAt.toISOString()})
+      VALUES (${key}, ${dataToStore}, ${expiresAt.toISOString()})
       ON CONFLICT (key) DO UPDATE SET
-        data = ${JSON.stringify(value)},
+        data = ${dataToStore},
         expires_at = ${expiresAt.toISOString()}
     `;
   }

netlify/functions/infrastructure/oauth/stores/UserSessionStore.ts

···
 
   async get(sessionId: string): Promise<UserSessionData | undefined> {
     const result = await this.sql`
-      SELECT did FROM user_sessions
+      SELECT did, fingerprint FROM user_sessions
       WHERE session_id = ${sessionId} AND expires_at > NOW()
     `;
     const rows = result as UserSessionRow[];
-    return rows[0] ? { did: rows[0].did } : undefined;
+    return rows[0]
+      ? { did: rows[0].did, fingerprint: rows[0].fingerprint }
+      : undefined;
   }
 
   async set(sessionId: string, data: UserSessionData): Promise<void> {
     const expiresAt = new Date(Date.now() + CONFIG.SESSION_EXPIRY);
     await this.sql`
-      INSERT INTO user_sessions (session_id, did, expires_at)
-      VALUES (${sessionId}, ${data.did}, ${expiresAt})
+      INSERT INTO user_sessions (session_id, did, fingerprint, expires_at)
+      VALUES (${sessionId}, ${data.did}, ${JSON.stringify(data.fingerprint)}, ${expiresAt})
       ON CONFLICT (session_id) DO UPDATE SET
         did = ${data.did},
+        fingerprint = ${JSON.stringify(data.fingerprint)},
         expires_at = ${expiresAt}
     `;
   }

netlify/functions/oauth-callback.ts

···
 import { SimpleHandler } from "./core/types/api.types";
 import { createOAuthClient, getOAuthConfig } from "./infrastructure/oauth";
+import { createSecureSessionData } from "./core/middleware/session-security.middleware";
 import { userSessions } from "./infrastructure/oauth/stores";
 import { redirectResponse } from "./utils";
 import { withErrorHandling } from "./core/middleware";
···
   );
 
   const sessionId = crypto.randomUUID();
-  const did = result.session.did;
-  await userSessions.set(sessionId, { did });
+  const secureData = createSecureSessionData(event, result.session.did);
+
+  await userSessions.set(sessionId, {
+    did: secureData.did,
+    fingerprint: secureData.fingerprint,
+  });
 
   console.log("[oauth-callback] Created user session:", sessionId);
 

netlify/functions/services/SessionService.ts

···
 import { Agent } from "@atproto/api";
 import type { NodeOAuthClient } from "@atproto/oauth-client-node";
+import { SessionSecurityService } from "../core/middleware/session-security.middleware";
 import type { HandlerEvent } from "@netlify/functions";
 import { AuthenticationError, ERROR_MESSAGES } from "../core/errors";
 import { createOAuthClient } from "../infrastructure/oauth";
 import { userSessions } from "../infrastructure/oauth/stores";
 import { configCache } from "../infrastructure/cache/CacheService";
+import { sessionStore } from "../infrastructure/oauth/stores";
 
 export class SessionService {
   static async getAgentForSession(
     sessionId: string,
-    event?: HandlerEvent,
+    event: HandlerEvent,
   ): Promise<{
     agent: Agent;
     did: string;
···
       throw new AuthenticationError(ERROR_MESSAGES.INVALID_SESSION);
     }
 
+    const currentFingerprint =
+      SessionSecurityService.generateFingerprint(event);
+    if (
+      userSession.fingerprint &&
+      !SessionSecurityService.verifyFingerprint(
+        userSession.fingerprint,
+        currentFingerprint,
+      )
+    ) {
+      throw new AuthenticationError("Session hijacking detected");
+    }
+
     const did = userSession.did;
     console.log("[SessionService] Found user session for DID:", did);
 
···
 
     const oauthSession = await client.restore(did);
     console.log("[SessionService] Restored OAuth session for DID:", did);
+
+    // Log token rotation for monitoring
+    // The restore() call automatically refreshes if needed
+    const sessionData = await sessionStore.get(did);
+    if (sessionData) {
+      // Token refresh happens transparently in restore()
+      // Just log for monitoring purposes
+      console.log("[SessionService] OAuth session restored/refreshed");
+    }
 
     const agent = new Agent(oauthSession);
 

netlify/functions/utils/encryption.utils.ts

···
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { ApiError } from "../core/errors";
+
+/**
+ * Token Encryption Service
+ * Encrypts sensitive OAuth tokens at rest using AES-256-GCM
+ */
+
+function getEncryptionKey(): Buffer {
+  const key = process.env.TOKEN_ENCRYPTION_KEY;
+
+  if (!key) {
+    throw new ApiError(
+      "Encryption key not configured",
+      500,
+      "TOKEN_ENCRYPTION_KEY environment variable is required",
+    );
+  }
+
+  // Expect 64-char hex string (32 bytes)
+  if (key.length !== 64) {
+    throw new ApiError(
+      "Invalid encryption key",
+      500,
+      "TOKEN_ENCRYPTION_KEY must be 64 hex characters (32 bytes)",
+    );
+  }
+
+  return Buffer.from(key, "hex");
+}
+
+interface EncryptedPayload {
+  iv: string;
+  data: string;
+  tag: string;
+}
+
+/**
+ * Encrypt sensitive data using AES-256-GCM
+ * @param data - Data to encrypt (will be JSON stringified)
+ * @returns Encrypted payload as JSON string
+ */
+export function encryptToken(data: any): string {
+  try {
+    const key = getEncryptionKey();
+    const iv = randomBytes(16);
+
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+
+    const jsonData = JSON.stringify(data);
+    const encrypted = Buffer.concat([
+      cipher.update(jsonData, "utf8"),
+      cipher.final(),
+    ]);
+
+    const authTag = cipher.getAuthTag();
+
+    const payload: EncryptedPayload = {
+      iv: iv.toString("hex"),
+      data: encrypted.toString("hex"),
+      tag: authTag.toString("hex"),
+    };
+
+    return JSON.stringify(payload);
+  } catch (error) {
+    console.error("Token encryption failed:", error);
+    throw new ApiError(
+      "Failed to encrypt token",
+      500,
+      error instanceof Error ? error.message : "Unknown encryption error",
+    );
+  }
+}
+
+/**
+ * Decrypt sensitive data
+ * @param encrypted - Encrypted payload as JSON string
+ * @returns Decrypted data
+ */
+export function decryptToken(encrypted: string): any {
+  try {
+    const key = getEncryptionKey();
+    const payload: EncryptedPayload = JSON.parse(encrypted);
+
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      key,
+      Buffer.from(payload.iv, "hex"),
+    );
+
+    decipher.setAuthTag(Buffer.from(payload.tag, "hex"));
+
+    const decrypted = Buffer.concat([
+      decipher.update(Buffer.from(payload.data, "hex")),
+      decipher.final(),
+    ]);
+
+    return JSON.parse(decrypted.toString("utf8"));
+  } catch (error) {
+    console.error("Token decryption failed:", error);
+    throw new ApiError(
+      "Failed to decrypt token",
+      500,
+      error instanceof Error ? error.message : "Unknown decryption error",
+    );
+  }
+}
+
+/**
+ * Generate a new encryption key (for initial setup)
+ * Run this once and store in environment variables
+ */
+export function generateEncryptionKey(): string {
+  return randomBytes(32).toString("hex");
+}
+
+/**
+ * Check if encryption is properly configured
+ * Returns false in development if key is missing (with warning)
+ */
+export function isEncryptionConfigured(): boolean {
+  const key = process.env.TOKEN_ENCRYPTION_KEY;
+
+  if (!key) {
+    if (process.env.NODE_ENV === "production") {
+      throw new ApiError(
+        "Encryption key not configured in production",
+        500,
+        "TOKEN_ENCRYPTION_KEY is required in production",
+      );
+    }
+    console.warn(
+      "⚠️  TOKEN_ENCRYPTION_KEY not set - tokens will NOT be encrypted",
+    );
+    return false;
+  }
+
+  return true;
+}

netlify/functions/utils/index.ts

···
 export * from "./response.utils";
 export * from "./string.utils";
+export * from "./encryption.utils";

package.json

···
     "dev:mock": "vite --mode mock",
     "dev:full": "netlify dev",
     "build": "vite build",
-    "init-db": "tsx scripts/init-local-db.ts"
+    "init-db": "tsx scripts/init-local-db.ts",
+    "generate-key": "tsx scripts/generate-encryption-key.ts"
   },
   "dependencies": {
     "@atcute/identity": "^1.1.0",

scripts/generate-encryption-key.ts

···
+import { randomBytes } from "crypto";
+
+/**
+ * Generate encryption key for token storage
+ * Run once: npx tsx scripts/generate-encryption-key.ts
+ */
+
+const key = randomBytes(32).toString("hex");
+
+console.log("\n🔐 TOKEN ENCRYPTION KEY GENERATED\n");
+console.log("Add this to your .env file and Netlify environment variables:\n");
+console.log(`TOKEN_ENCRYPTION_KEY=${key}\n`);
+console.log("⚠️  IMPORTANT:");
+console.log("1. Keep this key secret and secure");
+console.log("2. Never commit this to git");
+console.log(
+  "3. Use the same key across all environments to decrypt existing tokens",
+);
+console.log(
+  "4. If you lose this key, all encrypted tokens will be unrecoverable\n",
+);

scripts/keygen.js

···
+import { generateKeyPair, exportJWK, exportPKCS8 } from "jose";
+import { writeFileSync } from "fs";
+
+async function generateKeys() {
+  // Generate ES256 key pair (recommended by atproto)
+  const { publicKey, privateKey } = await generateKeyPair("ES256", {
+    extractable: true,
+  });
+
+  // Export public key as JWK (for client-metadata.json)
+  const publicJWK = await exportJWK(publicKey);
+  publicJWK.kid = "main-key"; // Key ID
+  publicJWK.use = "sig"; // Signature use
+  publicJWK.alg = "ES256";
+
+  // Export private key as PKCS8 (for environment variable)
+  const privateKeyPem = await exportPKCS8(privateKey);
+
+  console.log("\n=== PUBLIC KEY (JWK) ===");
+  console.log("Add this to your client-metadata.json jwks.keys array:");
+  console.log(JSON.stringify(publicJWK, null, 2));
+
+  console.log("\n=== PRIVATE KEY (PEM) ===");
+  console.log(
+    "Add this to Netlify environment variables as OAUTH_PRIVATE_KEY:",
+  );
+  console.log(privateKeyPem);
+
+  // Save to files for reference
+  writeFileSync("public-jwk.json", JSON.stringify(publicJWK, null, 2));
+  writeFileSync("private-key.pem", privateKeyPem);
+
+  console.log("\n✅ Keys saved to public-jwk.json and private-key.pem");
+  console.log("⚠️  Keep private-key.pem SECRET! Add it to .gitignore");
+}
+
+generateKeys().catch(console.error);