Encrypt Messages

flutter pub add cryptography http

import 'dart:convert';

import 'package:cryptography/cryptography.dart';
import 'package:stream_chat_flutter/stream_chat_flutter.dart';

/// A key, together with the id saved next to each message encrypted with it.
typedef KeyWithId = ({String id, SecretKey key});

/// Encrypts the text of messages before they are sent, and decrypts it after they arrive.
///
/// The encrypted text is saved in the message's custom data under `enc`, and the message text
/// is replaced with a placeholder.
class MessageCipher {
  /// Creates a cipher that gets its keys from [currentKey] and [keyById].
  MessageCipher({required this.currentKey, required this.keyById});

  /// Returns the key to encrypt new messages in a channel with.
  final Future<KeyWithId> Function(Channel channel) currentKey;

  /// Returns the key with a given id, to decrypt a message in a channel.
  final Future<SecretKey> Function(String cid, String keyId) keyById;

  /// The custom data field that holds a message's encrypted text.
  static const field = 'enc';

  /// The version of the format this cipher writes, saved with every message as `v`.
  static const formatVersion = 1;

  static const _placeholder = 'Encrypted message';

  final _aes = AesGcm.with256bits();

  /// Returns a copy of [message] with its text encrypted.
  ///
  /// The copy's text is a placeholder that keeps the message's mentions, so mentioned users are
  /// still notified. If [message] has no text, the copy has no encrypted text either, so an edit
  /// that removes the text doesn't keep showing the old one.
  Future<Message> encrypt(Channel channel, Message message) async {
    final text = message.text;
    if (text == null || text.isEmpty) {
      if (!message.extraData.containsKey(field)) return message;
      return message.copyWith(extraData: {...message.extraData}..remove(field));
    }

    final key = await currentKey(channel);
    final box = await _aes.encrypt(
      utf8.encode(text),
      secretKey: key.key,
      nonce: _aes.newNonce(),
      aad: _boundTo(channel.cid!, message),
    );

    return message.copyWith(
      text: [_placeholder, ..._mentionTokens(message)].join(' '),
      extraData: {
        ...message.extraData,
        field: {
          'v': formatVersion,
          'kid': key.id,
          'iv': base64.encode(box.nonce),
          'ct': base64.encode(box.concatenation(nonce: false)),
        },
      },
    );
  }

  /// Returns the decrypted text of [message], or null if [message] isn't encrypted.
  ///
  /// Throws a [FormatException] if the encrypted text is in a format this cipher doesn't know,
  /// and a [SecretBoxAuthenticationError] if it was changed, or copied from another message.
  Future<String?> decrypt(String cid, Message message) async {
    final encrypted = message.extraData[field];
    if (encrypted == null) return null;

    if (encrypted case {
      'v': formatVersion,
      'kid': final String keyId,
      'iv': final String nonce,
      'ct': final String ciphertext,
    }) {
      final box = SecretBox.fromConcatenation(
        [...base64.decode(nonce), ...base64.decode(ciphertext)],
        nonceLength: _aes.nonceLength,
        macLength: _aes.macAlgorithm.macLength,
      );
      final key = await keyById(cid, keyId);
      final bytes = await _aes.decrypt(box, secretKey: key, aad: _boundTo(cid, message));
      return utf8.decode(bytes);
    }
    throw FormatException('Message ${message.id} has encrypted text in an unknown format.');
  }

  // Ties the encrypted text to one message, so it can't be copied into another.
  List<int> _boundTo(String cid, Message message) => utf8.encode('$cid|${message.id}');

  // The SDK drops every mention whose @-token isn't in the message text, so the placeholder
  // keeps the tokens of the mentions that are still in the text. The composer doesn't forget a
  // mention when its @-token is deleted, so the text decides, as it does in the SDK.
  List<String> _mentionTokens(Message message) {
    final text = message.text ?? '';
    bool mentions(String token) =>
        RegExp('(?<![A-Za-z0-9_])@${RegExp.escape(token)}(?![A-Za-z0-9_])').hasMatch(text);

    return [
      for (final user in message.mentionedUsers)
        if (mentions(user.id) || mentions(user.name)) '@${user.id}',
      if ((message.mentionedChannel ?? false) && mentions('channel')) '@channel',
      if ((message.mentionedHere ?? false) && mentions('here')) '@here',
      for (final role in message.mentionedRoles ?? const <String>[])
        if (mentions(role)) '@$role',
      for (final group in message.mentionedGroups ?? const <UserGroup>[])
        if (mentions(group.name)) '@${group.name}',
    ];
  }
}

import 'dart:convert';

import 'package:stream_chat_flutter/stream_chat_flutter.dart';

/// Whether [message] has anything to send: text, attachments or a poll.
bool hasContent(Message message) =>
    (message.text?.trim().isNotEmpty ?? false) || message.attachments.isNotEmpty || message.pollId != null;

/// Whether the encrypted text of [message] fits in the message's custom data.
///
/// Encrypted text takes about a third more space than the original, and custom data is limited
/// to 5 KB. 3,000 bytes of text leaves room for the rest of the message's custom data.
bool fitsInCustomData(Message message) => utf8.encode(message.text ?? '').length <= 3000;

import 'dart:async';
import 'dart:convert';

import 'package:cryptography/cryptography.dart';
import 'package:http/http.dart' as http;
import 'package:stream_chat_flutter/stream_chat_flutter.dart';

import 'message_cipher.dart';

/// A client for the key endpoint on your app's own server.
///
/// Keys are kept in memory until [close] is called, and are never written to disk. Requests for
/// the same keys are shared between callers.
class ChannelKeys {
  /// Creates a client for the key endpoint at [endpoint].
  ///
  /// The [authorization] function is called before every request, and its result is sent as the
  /// `Authorization` header.
  ChannelKeys({required this.endpoint, required this.authorization});

  /// The URL of the key endpoint, such as `https://example.com/channel-keys`.
  final Uri endpoint;

  /// Returns the `Authorization` header value for [endpoint].
  ///
  /// The value comes from your app's own login, such as a session token, not from the Stream
  /// token.
  final Future<String> Function() authorization;

  static const _timeout = Duration(seconds: 10);
  static const _retryUnknownKeysAfter = Duration(minutes: 1);

  final _http = http.Client();
  final _keys = <String, SecretKey>{}; // '$cid/$keyId' -> key
  final _currentKeys = <String, ({int keyVersion, String id})>{}; // cid -> current key id
  final _requests = <String, Future<String>>{}; // running requests, shared between callers
  final _unknownKeyIds = <String, DateTime>{}; // '$cid/$keyId' -> when to ask for it again
  var _isClosed = false;

  /// Whether the key for new messages in [channel] is loaded, so [currentKey] returns at once.
  bool hasCurrentKey(Channel channel) => _currentKeys[channel.cid]?.keyVersion == _keyVersion(channel);

  /// Returns the key to encrypt new messages in [channel] with.
  ///
  /// The endpoint decides which key is current. The channel's `key_version` only tells this
  /// class when to ask again, because channel owners can change it.
  ///
  /// Throws a [StateError] if the endpoint refuses the request, for example because the current
  /// user isn't a member of [channel], and a [TimeoutException] or an [http.ClientException] if
  /// the endpoint can't be reached.
  Future<KeyWithId> currentKey(Channel channel) async {
    final cid = channel.cid!;
    final keyVersion = _keyVersion(channel);

    var id = switch (_currentKeys[cid]) {
      (keyVersion: final loadedFor, :final id) when loadedFor == keyVersion => id,
      _ => null,
    };
    if (id == null) {
      id = await _load(cid, cid);
      // A request that started before the key version changed returns the previous key.
      if (_versionOf(id) < keyVersion) id = await _load(cid, cid);
      _currentKeys[cid] = (keyVersion: keyVersion, id: id);
    }
    return (id: id, key: _keys['$cid/$id']!);
  }

  /// Returns the key named [keyId], to decrypt a message in the channel [cid].
  ///
  /// Throws a [StateError] if the endpoint refuses the request or doesn't know the key, and a
  /// [FormatException] if its response can't be read. After either, the key isn't asked for again
  /// for a minute, so a message with an unknown key id can't make the app call the endpoint on
  /// every update. A request that fails on the network is tried again the next time.
  Future<SecretKey> keyById(String cid, String keyId) async {
    final cacheKey = '$cid/$keyId';
    if (_keys[cacheKey] case final key?) return key;

    final retryAt = _unknownKeyIds[cacheKey];
    if (retryAt == null || DateTime.now().isAfter(retryAt)) {
      try {
        // Most messages use a key of the current master secret, which one request returns. It's
        // shared with currentKey, so opening a channel makes one request.
        await _load(cid, cid);
        // Older messages can use an older master secret, which needs its own request.
        if (!_keys.containsKey(cacheKey)) await _load(cacheKey, cid, keyId: keyId);
      } on StateError {
        _unknownKeyIds[cacheKey] = DateTime.now().add(_retryUnknownKeysAfter);
        rethrow;
      } on FormatException {
        _unknownKeyIds[cacheKey] = DateTime.now().add(_retryUnknownKeysAfter);
        rethrow;
      }
      if (_keys[cacheKey] case final key?) return key;
      _unknownKeyIds[cacheKey] = DateTime.now().add(_retryUnknownKeysAfter);
    }
    throw StateError('The key endpoint has no key $keyId for $cid.');
  }

  /// Closes the connection to the key endpoint and forgets every key.
  ///
  /// Call it when the user logs out. Requests that are still running don't store their keys,
  /// and this object can't be used afterwards.
  void close() {
    _isClosed = true;
    _keys.clear();
    _currentKeys.clear();
    _unknownKeyIds.clear();
    _http.close();
  }

  static int _keyVersion(Channel channel) => switch (channel.extraData['key_version']) {
    final int version => version,
    _ => 1,
  };

  // The channel key version in a key id such as '2.5'.
  static int _versionOf(String keyId) => int.tryParse(keyId.split('.').last) ?? 0;

  // Fetches keys, sharing the request with other callers that use the same requestKey.
  // Returns the id of the channel's current key.
  Future<String> _load(String requestKey, String cid, {String? keyId}) {
    return _requests[requestKey] ??= _fetch(cid, keyId: keyId).whenComplete(() {
      _requests.remove(requestKey);
    });
  }

  Future<String> _fetch(String cid, {String? keyId}) async {
    if (_isClosed) throw StateError('ChannelKeys is closed.');

    final response = await _http
        .get(
          endpoint.replace(queryParameters: {'cid': cid, if (keyId != null) 'kid': keyId}),
          headers: {'Authorization': await authorization()},
        )
        .timeout(_timeout);
    if (_isClosed) throw StateError('ChannelKeys is closed.');
    if (response.statusCode != 200) {
      throw StateError(
        'The key endpoint returned HTTP ${response.statusCode} for $cid. '
        'Check that the user is logged in to the app and is a member of the channel.',
      );
    }

    // The response must include the current key, unless it's for one older key.
    if (jsonDecode(response.body) case {
      'current': final String current,
      'keys': final Map<String, Object?> keys,
    } when keyId != null || keys[current] is String) {
      for (final MapEntry(key: id, value: key) in keys.entries) {
        if (key is String) _keys['$cid/$id'] = SecretKey(base64.decode(key));
      }
      return current;
    }
    throw FormatException('The key endpoint returned a response without current and its key.', response.body);
  }
}

final channelKeys = ChannelKeys(
  endpoint: Uri.parse('https://example.com/channel-keys'),
  authorization: () async => 'Bearer ${await yourSessionToken()}',
);
final cipher = MessageCipher(currentKey: channelKeys.currentKey, keyById: channelKeys.keyById);

StreamChat(
  client: client,
  componentBuilders: StreamComponentBuilders(
    extensions: streamChatComponentBuilders(
      messageComposer: (context, props) => DefaultStreamMessageComposer(
        props: _encrypting(context, StreamChannel.of(context).channel, props),
      ),
    ),
  ),
  child: child,
);

// Encrypts what every composer sends: in channels, in threads and in the SDK's own pages.
MessageComposerProps _encrypting(BuildContext context, Channel channel, MessageComposerProps props) {
  return props.copyWith(
    preMessageSending: (message) => cipher.encrypt(channel, message),
    validator: (message) => _canSend(context, channel, message),
    ogPreviewFilter: (_, _) => false, // don't send typed links out for previews
    disableAttachments: true, // files would be uploaded unencrypted
    enableVoiceRecording: false, // recordings would be uploaded unencrypted
  );
}

// Holds the send back until the text fits and the channel's key is loaded. The composer keeps
// the text, and, unless the message is empty, the user is told why.
bool _canSend(BuildContext context, Channel channel, Message message) {
  if (!hasContent(message)) return false;

  final messenger = ScaffoldMessenger.maybeOf(context);
  void tell(String text) => messenger
    ?..hideCurrentSnackBar()
    ..showSnackBar(SnackBar(content: Text(text)));

  if (!fitsInCustomData(message)) {
    tell('This message is too long to send encrypted.');
    return false;
  }
  if (channelKeys.hasCurrentKey(channel)) return true;

  tell('Loading the encryption key. Tap Send again in a moment.');
  channelKeys.currentKey(channel).then(
    (_) {},
    // For example, the device is offline, or the user is no longer a member of the channel.
    // A block body: `then` throws if the error handler returns a value.
    onError: (Object _) {
      tell("Couldn't load the encryption key, so this message can't be sent yet.");
    },
  );
  return false;
}